Compliance, audit and data residency

Audit log

Every mutating action and every deployment decision is recorded as an immutable AuditEvent: who (actor), what (run.triggered, deployment.approved, secret.rotated…), the target, metadata, source IP and time. The log is append-only: there is no API to edit or delete entries.

Query it in the UI, or with AuditService / IdentityService.ListAuditEvents and filters:

curl -sS $BASE/slipway.v1.IdentityService/ListAuditEvents -H "Authorization: Bearer $T" \
  -H "Content-Type: application/json" \
  -d '{"filter":"action == \"deployment.approved\" && environment == \"production\"","page_size":100}'

Retention and export by plan

	Free	Team	Business	Enterprise
Audit log	30 days, in-app	90 days + export	1 year + streaming (S3, Splunk, Datadog)	Unlimited
Log / artifact retention	14 days / 7 days	90 days / 30 days	1 year / 180 days	Custom

Access reviews

Export current role bindings, tokens, service accounts and external identities for periodic review (SOC 2 CC6). Look for: owners and admins, tokens without expiry, service accounts with broad scopes, bindings to deploy:production.

Encryption

Data	Protection
Secrets	AES-256-GCM envelope encryption, per-org KEK, BYOK on Team+ (AWS KMS, GCP KMS, Azure Key Vault, Vault transit), HSM on Enterprise
Database and object storage	Encrypted at rest by the underlying provider (KMS-backed in the reference Terraform)
In transit	TLS 1.2+ on all external connections
Tokens	Hashed at rest (API tokens); job tokens not stored

Key rotation: the KEK can be rotated (re-wrapping data keys) and secrets can be re-set to rotate data keys. Rotation history is recorded in the keyring metadata.

Change management

Business and above can require a ServiceNow or Jira Change Management ticket before a production deployment. The deployment records the ticket, approvals and gate results, which is the evidence auditors ask for. See Gates.

Data residency

Slipway Cloud runs regional cells (EU and US). An org’s data (database rows, logs, artifacts) stays in its cell. Enterprise adds a dedicated cell or an air-gapped self-hosted install.

SOC 2 mapping

Controls are baked into the product rather than bolted on:

Trust criteria area	Where it lives
Logical access (CC6)	SSO, MFA, RBAC, access-review export, token policies
Change management (CC8)	Approvals, gates, change-ticket gates, immutable releases, deployment history
Monitoring (CC7)	Audit log with streaming, metrics, alerts
Encryption and keys	Envelope encryption, BYOK, rotation
Availability (A1)	HA reference, backups guidance, SLAs on Business and Enterprise

Privacy

See the privacy policy (placeholder until launch) and, for self-hosted installs, the fact that no data leaves your infrastructure unless you configure an integration.