# Gondola security overview

Last reviewed: September 4, 2026

This document is a portable summary for technical and vendor-security review. It describes implemented product boundaries and current assurance status. It is not a certification, audit report, penetration-test attestation, or service-level agreement.

## Product and deployment model

Gondola operates ephemeral GitHub Actions runners in an AWS account controlled by the customer. The Gondola controller runs on ECS Fargate in that account, communicates directly with GitHub and AWS, launches one EC2 instance for an assigned job, and removes the instance after the job. The normal deployment has no inbound product endpoint and no Gondola-operated service in the job execution or licensing path.

## Information boundary

| Information                                | Received by Gondola        | Normal location                                                                |
| ------------------------------------------ | -------------------------- | ------------------------------------------------------------------------------ |
| Repository source and job output           | No                         | GitHub and the runner inside customer AWS                                      |
| AWS credentials and GitHub App private key | No                         | Customer identity systems and secret store                                     |
| Runner logs and operational metrics        | No                         | Customer-selected CloudWatch destinations                                      |
| Subscription and entitlement records       | Yes                        | Gondola fulfillment database; bounded billing fields and cryptographic digests |
| Full payment-card details                  | No                         | Stripe-hosted Checkout                                                         |
| Support correspondence                     | Only when voluntarily sent | Gondola support systems                                                        |

The browser-based installation helpers do not submit GitHub App keys or AWS credentials to Gondola. Customers should remove credentials, repository content, personal information, and unrelated diagnostic material from support requests.

## Identity and access

- The GitHub App is private to the customer's GitHub account. Its private key is read by ECS directly from AWS Secrets Manager or Systems Manager Parameter Store and does not enter Terraform or OpenTofu state.
- The controller can launch only configured instance types through configured launch templates, subnets, security groups, images, and roles.
- `iam:PassRole` is limited to the configured runner roles and the EC2 service.
- The controller can terminate only instances carrying the applicable Gondola deployment tag.
- Runner IAM roles are separated by fleet. Customers define the permissions granted to workflow jobs.

## Network and workload isolation

- Controller and runner security groups have no inbound rules by default.
- Controllers and runners initiate outbound HTTPS connections to GitHub, AWS APIs, and customer-selected registries or package sources.
- Each EC2 runner accepts at most one job and is terminated afterward.
- Root EBS volumes are encrypted and deleted on termination.
- IMDSv2 is required and instance metadata tags are disabled.
- An independent hard-expiry timer bounds runner lifetime if the controller is unavailable.
- Docker-based Actions can control the disposable host through the Docker socket. Customers must not mix untrusted workflows with privileged fleet credentials.

## Software supply chain

- Production deployments require digest-pinned controller and runner images by default.
- Controller images, release manifests, and checksum files are signed by the release workflow using keyless Sigstore identities.
- Release bundles include checksums, per-binary SPDX SBOMs, third-party notices, and applicable dependency license material.
- OCI builds publish provenance and an image SBOM.
- Release CI includes formatting and static analysis, race-enabled tests, Go vulnerability scanning, dependency auditing, Terraform and OpenTofu validation, packaging checks, a container smoke test, and a disposable AWS/GitHub lifecycle gate.

Public review material:

- Trust and verification: https://gondola.build/trust
- Security model: https://gondola.build/security
- Architecture: https://gondola.build/docs/architecture
- Installation and signature verification: https://gondola.build/docs/install#release
- Public infrastructure module: https://github.com/gondola-build/terraform-aws-gondola
- Terraform Registry: https://registry.terraform.io/modules/gondola-build/gondola/aws/0.2.2
- OpenTofu Registry: https://search.opentofu.org/module/gondola-build/gondola/aws/0.2.2
- Public OCI package: https://github.com/orgs/gondola-build/packages/container/package/gondola

## Availability and recovery

The default deployment uses two controller tasks across Availability Zones. A conditional DynamoDB lease permits only one active GitHub listener. Already-running jobs continue during controller loss, and their independent hard-expiry timer remains active. Deployment health checks and the ECS deployment circuit breaker protect controller upgrades. Customer infrastructure state and the customer-owned GitHub App key remain customer recovery responsibilities.

## Security reporting and support

Suspected vulnerabilities should be reported privately to support@gondola.build. Gondola targets acknowledgement within one business day during published coverage hours. Do not include live credentials, JIT runner configuration, Terraform state, repository source, or full workflow payloads.

- Security reporting policy: https://gondola.build/security#reporting
- Machine-readable security contact: https://gondola.build/.well-known/security.txt
- Support: https://gondola.build/contact

## Current assurance status

Gondola does not currently claim SOC 2, ISO 27001, an independent penetration-test attestation, guaranteed uptime, or 24/7 support. Public signatures and provenance establish artifact identity and release origin; they do not establish that software is free of defects. The public infrastructure module exposes the AWS resources and permissions, while the proprietary controller source and internal CI logs are not public.

## Customer responsibilities

Customers remain responsible for AWS and GitHub administration, VPC and egress policy, runner IAM permissions, GitHub OIDC configuration, runner images, repository and trigger policy, workflow code, third-party Actions, infrastructure state, monitoring destinations, alert response, backups, and incident response inside their accounts.

For a security or procurement question, contact support@gondola.build.