# JFrog TrustFAQ

## FAQ

### JFrog Compliance

#### Certificate program

1. **Is JFrog SOC 2 Type II compliant?**  
   Yes, Ernst & Young has audited JFrog’s System and Organization Controls and issued SOC 2 Type II report, which explains the controls established to support our operations and compliance. Please read our certificate program [here](/content/trust/certificate-program/index.html).

2. **Is JFrog ISO 27001 compliant?**  
   Yes, JFrog is certified under ISO 27001, the international standard for information security management. Please read our certificate program [here](/content/trust/certificate-program/index.html).

#### Risk Assessment

1. **Do you have a formal information security policy that is reviewed at least once a year and approved by a senior executive?**  
   All policies are reviewed annually and approved by JFrog management.

2. **Do you perform an organization-wide security risk assessment?**  
   Yes, this is performed based on the methodology of ISO 27001.

### Product Security

#### Application security

1. **What security controls are in place to protect the JFrog infrastructure and applications (e.g. IDS, web application firewall)?**  
   As part of our multi-layer protection approach, a dedicated DDoS mitigation ecosystem has been put in place. JFrog utilizes anti-DDoS protection, a next-gen WAF, an API protection tool, advanced rate limiting, and bot protection.

2. **Does JFrog certify that the version of the application to be installed has been assessed with a compliant penetration test process?**  
   To complete our development lifecycle, our products and features are pentested on an ongoing basis, both internally, by the JFrog application security team, and externally, by third-party experts.

3. **Are there any networking tools used by JFrog to protect WAF, anti-DDoS?**  
   JFrog utilizes anti-DDoS protection, a next-gen WAF, an API protection tool, advanced rate limiting, and bot protection.

4. **How does JFrog tackle vulnerabilities in its products and within the Docker images delivered to customers?**  
   JFrog has a comprehensive and automated vulnerability management, threat prioritization, and patch deployment process to ensure that critical vulnerabilities are quickly detected, addressed, and remediated.

#### Account Security

1. **Is SAML 2.0 based identity federation supported?**  
   The JFrog Platform offers a SAML-based Single Sign-On service allowing federated JFrog partners full control over the authorization process.

2. **Does the JFrog platform provide controls for restricting user access to data?**  
   The JFrog Platform provides a flexible permissions model that gives administrators fine-grained control over how users and groups access different resources.

3. **How do you protect secrets such as user credentials, API tokens, and encryption keys?**  
   Customer-sensitive data, such as passwords and API keys, is encrypted by the applications.

#### Visibility & Monitoring

1. **What data is logged?**  
   The JFrog Platform provides audit trail logs and standardized logs for all JFrog products.

### Cloud Security

1. **What is the deployment model for the infrastructure supporting applications?**  
   JFrog customers can co-locate all cloud services with Artifactory Cloud on any major cloud provider: Google Cloud Platform (GCP), Amazon Web Services (AWS), or Microsoft Azure. JFrog also supports hybrid solutions.

2. **Does your organization maintain a publicly available system-status webpage?**  
   JFrog communicates the status of our platform and its incidents [here](https://status.jfrog.io/).

### Data

#### Data Encryption

1. **How is data protected in transit?**  
   Every customer’s data is encrypted in transit using HTTPS with TLS V1.2.

2. **If encryption is enabled on the hosted environment, how is data protected at rest?**  
   All hosted data at rest is securely stored using SHA-256 encryption.

3. **For data at rest encryption, how are encryption keys managed?**  
   All our encryption keys are stored and managed in a cloud-hosted key management service.

#### Data Management

1. **How is data securely deleted after an account is deactivated and terminated?**  
   A commercial customer account is typically deactivated after being inactive for 60 days, and data is deleted completely if not contacted.

2. **How is customer data isolated from other tenants’ data?**  
   Each customer account is deployed with a unique ID, and permission is managed on a least privilege principle.

### Security Incident Management

1. **How are anomalies detected?**  
   JFrog’s cyber incident response team continuously monitors logs and audits in our internal SIEM to detect potential incidents.

2. **Does your company have a Cyber Security Incident Response plan?**  
   Yes, we have a clearly defined and detailed Cyber Security Incident Response plan.

3. **Does the organization maintain 24x7 coverage for responding to security alerts?**  
   Yes, our SOC is staffed with qualified security experts.

4. **How do you continuously assess and remediate cyber vulnerabilities?**  
   JFrog has a program that assesses vulnerabilities from multiple sources and resolves them based on our internal SLA.

### Access Control & Identity Management

1. **What controls are in place for remote administrative access to the infrastructure?**  
   JFrog uses a zero trust solution for secure connections over our internal network.

2. **Which security controls do you use to protect against spoofed emails?**  
   JFrog uses SPF and DMARC email authentication methods.

3. **Describe your policy and security measures to manage the use of devices.**  
   All JFrog laptops are installed with MDM and enforced encryption policies.

### Awareness & Education

1. **Are all staff provided with training on information security policies?**  
   Yes, all JFrog employees have annual mandatory cyber security and privacy awareness training.

## Powering the Software that Powers the World

It’s our Liquid Software vision to automatically deliver software packages seamlessly and securely from any source to any device.