> ## Documentation Index
> Fetch the complete documentation index at: https://site.aspect.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and data handling

> What data Aspect Workflows holds on Aspect Cloud and on an Aspect Enterprise deployment, where it lives, who at Aspect can reach it, and how access, encryption and identity are handled.

export const gatedAccess = (user, group) => {
  const loggedIn = !!(user && user.loggedIn);
  const groups = user && user.tenantMetadata && user.tenantMetadata.docsGroups || [];
  if (loggedIn && (!group || groups.indexOf(group) >= 0)) {
    return "entitled";
  }
  return loggedIn ? "signed-in" : "anonymous";
};

export const GatedLink = ({access, href, group, children}) => {
  const note = group ? "Aspect Enterprise customers" : "free Aspect account";
  const muted = {
    fontSize: "0.85em",
    opacity: 0.7,
    whiteSpace: "nowrap"
  };
  if (access === "entitled") {
    return <a href={href}>{children}</a>;
  }
  if (access !== "signed-in") {
    return <span>
        <a href={"/login?redirect=" + encodeURIComponent(href)}>{children}</a>
        <span style={muted}> (sign in: {note})</span>
      </span>;
  }
  return <span>
      {children}
      <span style={muted}> ({note})</span>
    </span>;
};

This page is for your security team. It covers what Aspect Workflows stores, where that lives, who at Aspect can reach it, and what's enforced on the way in, on [Aspect Cloud](/docs/aspect-workflows/cloud/overview) and on an [Aspect Enterprise](/docs/aspect-workflows/enterprise/overview) deployment, whether [hosted by Aspect](/docs/aspect-workflows/enterprise/hosted/overview) or [self-hosted](/docs/aspect-workflows/enterprise/self-hosted).

Aspect is **SOC 2 Type 2 certified**.

## What Aspect Workflows stores

| Data               | What it is                                                                                           | Sensitivity                                  |
| ------------------ | ---------------------------------------------------------------------------------------------------- | -------------------------------------------- |
| **Cache contents** | Action inputs and outputs: object files, archives, test logs, anything Bazel produces                | Derived from your source; treat it as source |
| **Build events**   | The BEP stream: target outcomes, timings, test results, invocation metadata                          | Metadata plus test output                    |
| **Build logs**     | stdout/stderr from build and test actions                                                            | Whatever your tests print                    |
| **Runner state**   | The output base and workspace on a CI runner's local NVMe, kept between jobs. Aspect Enterprise only | A checkout of your repository                |

## Aspect Cloud

Aspect Cloud is Aspect's multi-tenant service. It runs the remote cache and the Build Results UI on infrastructure Aspect operates, in Aspect's cloud account, shared between customers.

|                                                                                | Aspect Cloud                                                                                                                                                                                            |
| ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **What it stores**                                                             | Cache contents, build events and build logs                                                                                                                                                             |
| **Where it lives**                                                             | Aspect's cloud account, on infrastructure shared between customers                                                                                                                                      |
| **Who operates it**                                                            | Aspect                                                                                                                                                                                                  |
| **Web surfaces**                                                               | Every web surface, including the Build Results UI, requires an authenticated Aspect account, over **OIDC / OAuth 2.0**                                                                                  |
| **Build endpoints**                                                            | The cache and build event endpoints authenticate every caller, with an Aspect login on a developer machine or an [Aspect API token](/docs/cli/authentication#generate-an-aspect-api-token-for-ci) on CI |
| **In transit**                                                                 | HTTPS/TLS on every public endpoint                                                                                                                                                                      |
| **At rest**                                                                    | Cache contents are encrypted with S3 server-side encryption                                                                                                                                             |
| **Single sign-on (SSO)** <span className="coming-soon-chip">Coming soon</span> | SSO through Aspect sign-in, connected to your identity provider.                                                                                                                                        |

If your policy requires infrastructure and data no other customer shares, or data in your own cloud account, choose Aspect Enterprise. [Choosing Aspect Cloud or Aspect Enterprise](/docs/aspect-workflows/platform/choosing) compares them.

## Aspect Enterprise

Aspect Enterprise is an isolated deployment for your organization, hosted by Aspect or self-hosted. A third option, on-prem (coming soon), deploys with a Helm chart on your own hardware.

### Runner state

Runners check your repository out the way your existing CI runners do, using credentials your CI provider issues. That checkout sits on the runner's local disk, persists between jobs, and goes away when the runner is recycled. Apart from the runner's checkout and the source files Bazel uploads to the cache as action inputs, no part of the deployment stores your source.

### Where it lives

Both Aspect Enterprise options give you **data isolation**: no other customer shares your cache, your workers or your build event database. Self-hosted adds **data ownership**: the account, the cloud bill, the credentials, the retention policy and the audit trail are yours, and build data never leaves infrastructure you control.

|                            | Hosted by Aspect            | Self-hosted                     |
| -------------------------- | --------------------------- | ------------------------------- |
| **Infrastructure**         | Isolated, in Aspect's cloud | Isolated, in your cloud account |
| **Cache and build events** | Aspect's cloud              | Your account                    |
| **Who owns the storage**   | Aspect                      | You                             |
| **Retention set by**       | You, applied by Aspect      | You                             |
| **Deletion**               | Aspect, on request          | You, directly                   |
| **Air-gapped / GovCloud**  | —                           | ✓                               |

### Who at Aspect can reach it

On an Aspect Enterprise deployment hosted by Aspect, Aspect operates the infrastructure and its engineers hold the credentials to do so.

On self-hosted, **you decide**, from Aspect-managed, where Aspect maintains it and your team keeps access for visibility, through co-maintained and customer-managed, to no Aspect access at all. [Who operates it](/docs/aspect-workflows/enterprise/self-hosted#who-operates-it) lays out each arrangement and what it means for incident response. Read-only is required for any shared account: Aspect doesn't hold write credentials beside infrastructure it doesn't manage.

The roles Aspect uses are least-privilege rather than blanket admin, and every action they take lands in your AWS CloudTrail or GCP audit log. <GatedLink access={gatedAccess(user, "workflows-subscriber")} href="/docs/aspect-workflows/enterprise/self-hosted/alerts/support-and-alerting#support-roles" group="workflows-subscriber">Support and alerting</GatedLink> lists each role and its permissions.

### Identity and access

* **Every web surface requires an authenticated user**, including the Build Results UI. By default that's an Aspect account, authenticated over **OIDC / OAuth 2.0**.
* **Build endpoints authenticate every caller**, separately from the web surfaces, and serve an OAuth discovery document so clients can configure themselves. See [authenticating to a deployment](/docs/aspect-workflows/enterprise/connect/local-setup).
* **SSO through Aspect sign-in.** Your identity provider connects to Aspect sign-in, so people sign in with their corporate account. Aspect sign-in still manages the accounts and issues Aspect API tokens, so CI authenticates as before.
* **Your own identity provider, replacing Aspect sign-in.** The deployment trusts your identity provider directly, with no Aspect accounts in between. There are no Aspect API tokens either, so read [what CI has to do instead](/docs/aspect-workflows/enterprise/connect/ci-setup#if-the-deployment-uses-your-own-identity-provider) before you decide.
* **SCIM provisioning**, with Aspect sign-in. Syncs users from your directory into Aspect sign-in, so people who join or leave are added or removed without invites. With your own identity provider there's nothing to sync: you manage users and groups there directly.

### In transit and at rest

**In transit:** HTTPS/TLS on every public endpoint, TLS 1.2 or later.

**At rest:**

| Data                      | AWS                                                                                                                 | GCP                             |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------- | ------------------------------- |
| **Cache contents**        | S3 server-side encryption by default, or SSE-KMS with a customer-managed key you supply                             | Google Cloud default encryption |
| **Build events and logs** | Encrypted EBS with a deployment KMS key for the build event database; S3 server-side encryption for archived events | Google Cloud default encryption |
| **Runner root volumes**   | Encrypted EBS                                                                                                       | Google Cloud default encryption |

### Network exposure

The default is authenticated public endpoints, so laptops and CI anywhere can reach the cache. Private endpoints and VPC peering are optional customizations.

| Option                | What it is                                                                                                              | Hosted by Aspect | Self-hosted |
| --------------------- | ----------------------------------------------------------------------------------------------------------------------- | ---------------- | ----------- |
| **Public endpoints**  | Authenticated, reachable from anywhere                                                                                  | ✓                | ✓           |
| **Private endpoints** | AWS PrivateLink or GCP Private Service Connect from your VPCs. One-directional, no route exchange, no CIDR coordination | ✓                | ✓           |
| **In-VPC only**       | No public endpoint at all                                                                                               | —                | ✓           |
| **VPC peering**       | Only where actions inside the deployment must reach private services on your side                                       | —                | ✓           |

See [network topology](/docs/aspect-workflows/enterprise/self-hosted#network-topology).

### What Aspect collects about the deployment

Operational telemetry about Aspect-maintained infrastructure (the metrics and alerts that on-call relies on), plus aggregate usage for billing. Deployments also send Aspect a daily sanitized summary of their module configuration, which is how upgrade guidance stays specific to what you actually run.

Aspect does not collect data from customer repositories. See the [security overview](/security-overview) for more details.