FAQ | JFrog

JFrog TrustFAQ

Is JFrog SOC 2 Type II compliant?
Yes, Ernst & Young has audited JFrog’s System and Organization Controls and issued SOC 2 Type II report, which explains the controls established to support our operations and compliance. Please read our certificate program here.
Is JFrog ISO 27001 compliant?
Yes, JFrog is certified under ISO 27001, the international standard for information security management. Please read our certificate program here.

Do you have a formal information security policy that is reviewed at least once a year and approved by a senior executive?
All policies are reviewed annually and approved by JFrog management.
Do you perform an organization-wide security risk assessment?
Yes, this is performed based on the methodology of ISO 27001.

What security controls are in place to protect the JFrog infrastructure and applications (e.g. IDS, web application firewall)?
As part of our multi-layer protection approach, a dedicated DDoS mitigation ecosystem has been put in place. JFrog utilizes anti-DDoS protection, a next-gen WAF, an API protection tool, advanced rate limiting, and bot protection.
Does JFrog certify that the version of the application to be installed has been assessed with a compliant penetration test process?
To complete our development lifecycle, our products and features are pentested on an ongoing basis, both internally, by the JFrog application security team, and externally, by third-party experts.
Are there any networking tools used by JFrog to protect WAF, anti-DDoS?
JFrog utilizes anti-DDoS protection, a next-gen WAF, an API protection tool, advanced rate limiting, and bot protection.
How does JFrog tackle vulnerabilities in its products and within the Docker images delivered to customers?
JFrog has a comprehensive and automated vulnerability management, threat prioritization, and patch deployment process to ensure that critical vulnerabilities are quickly detected, addressed, and remediated.

Is SAML 2.0 based identity federation supported?
The JFrog Platform offers a SAML-based Single Sign-On service allowing federated JFrog partners full control over the authorization process.
Does the JFrog platform provide controls for restricting user access to data?
The JFrog Platform provides a flexible permissions model that gives administrators fine-grained control over how users and groups access different resources.
How do you protect secrets such as user credentials, API tokens, and encryption keys?
Customer-sensitive data, such as passwords and API keys, is encrypted by the applications.

What data is logged?
The JFrog Platform provides audit trail logs and standardized logs for all JFrog products.

What is the deployment model for the infrastructure supporting applications?
JFrog customers can co-locate all cloud services with Artifactory Cloud on any major cloud provider: Google Cloud Platform (GCP), Amazon Web Services (AWS), or Microsoft Azure. JFrog also supports hybrid solutions.
Does your organization maintain a publicly available system-status webpage?
JFrog communicates the status of our platform and its incidents here.

How is data protected in transit?
Every customer’s data is encrypted in transit using HTTPS with TLS V1.2.
If encryption is enabled on the hosted environment, how is data protected at rest?
All hosted data at rest is securely stored using SHA-256 encryption.
For data at rest encryption, how are encryption keys managed?
All our encryption keys are stored and managed in a cloud-hosted key management service.

How is data securely deleted after an account is deactivated and terminated?
A commercial customer account is typically deactivated after being inactive for 60 days, and data is deleted completely if not contacted.
How is customer data isolated from other tenants’ data?
Each customer account is deployed with a unique ID, and permission is managed on a least privilege principle.

How are anomalies detected?
JFrog’s cyber incident response team continuously monitors logs and audits in our internal SIEM to detect potential incidents.
Does your company have a Cyber Security Incident Response plan?
Yes, we have a clearly defined and detailed Cyber Security Incident Response plan.
Does the organization maintain 24x7 coverage for responding to security alerts?
Yes, our SOC is staffed with qualified security experts.
How do you continuously assess and remediate cyber vulnerabilities?
JFrog has a program that assesses vulnerabilities from multiple sources and resolves them based on our internal SLA.

What controls are in place for remote administrative access to the infrastructure?
JFrog uses a zero trust solution for secure connections over our internal network.
Which security controls do you use to protect against spoofed emails?
JFrog uses SPF and DMARC email authentication methods.
Describe your policy and security measures to manage the use of devices.
All JFrog laptops are installed with MDM and enforced encryption policies.

Are all staff provided with training on information security policies?
Yes, all JFrog employees have annual mandatory cyber security and privacy awareness training.

It’s our Liquid Software vision to automatically deliver software packages seamlessly and securely from any source to any device.