Trust Center
Request our SOC 2 Type 2 report and penetration test report, and sign our Data Processing Agreement.
Reports and agreements
Do you have a SOC 2 report?
Do you have a SOC 2 report?
Yes. You can request our SOC 2 Type 2 report, along with our most recent penetration test report, through our Trust Center.
Can we sign a Data Processing Agreement, and can we sign it before signup?
Can we sign a Data Processing Agreement, and can we sign it before signup?
Yes. Our Data Processing Agreement, which covers Article 28 of the GDPR, is available through our Trust Center and can be signed there before or at signup.If you run into any problem executing the document, email us at support@ubicloud.com and we’ll help.
How we handle your data
Is our code used for anything other than running our jobs?
Is our code used for anything other than running our jobs?
No. Customer source code, logs, caches and artifacts are used strictly to run your jobs, and never for analytics, product development, benchmarking, or training AI or machine-learning models.
What happens to the runner VM after a job finishes?
What happens to the runner VM after a job finishes?
Every job runs on a fresh, fully isolated virtual machine provisioned with Linux KVM. When the job finishes, the VM and its block storage are destroyed immediately, and we crypto-shred the storage so that no data persists between jobs.We don’t capture or back up job output, source code or build artifacts. See GitHub Actions Security for more on our ephemeral VM and just-in-time runner model.
What data do you retain, and for how long?
What data do you retain, and for how long?
We retain control plane metadata about each job, such as when it was initiated, its start time and duration, the hardware selected and the IP addresses involved. This is what lets us maintain an audit trail and investigate security incidents.Cache entries are removed automatically after seven days without access. Service and audit logs follow our SOC 2 retention guidelines, up to 180 days for audit logs.
Which Ubicloud employees can access a runner VM, its disk, logs or cache?
Which Ubicloud employees can access a runner VM, its disk, logs or cache?
Engineer access to a runner VM, its disk, logs or cache is restricted by job role and operational necessity. All access is logged, and your data is encrypted both at rest and in transit.
Where your jobs run
Where are our runners and caches located?
Where are our runners and caches located?
Ubicloud runners process data within Europe by default. Most of our fleet runs on Hetzner hosts in Germany (FSN1), alongside Leaseweb hosts in Germany (FRA-01), and we’re diversifying providers to avoid a single point of failure.At times of high demand we can fall back to external compute providers such as AWS in eu-central-1 (Frankfurt) to prevent long queue times. That region is also within the EU.US runners are available but are only used if you explicitly ask us to enable them. Email support@ubicloud.com if you need them.
Who are your subprocessors?
Who are your subprocessors?
Our current subprocessor list, including locations, is published at Sub-processors.
GitHub App permissions
Which permissions does the Ubicloud Managed Runners app need, and why?
Which permissions does the Ubicloud Managed Runners app need, and why?
The app requests three repository permissions:
GitHub doesn’t offer lighter-weight permissions that allow us to register runners at the repository level and check job status.
Can we install the app on selected repositories only?
Can we install the app on selected repositories only?
Yes. You can enable our GitHub App for selected repositories rather than across your whole organization.
If your review raises something this page doesn’t cover, email us at support@ubicloud.com and you’ll be talking directly to our engineers.