Our SOC 2 Type 2 report. Security defaults on your clusters.
Ybor runs in your cloud account, under your IAM, inside your network boundary. We never hold your data, which turns most of the vendor questionnaire into a conversation about our controls instead of your exposure. The SOC 2 Type 2 report covers the rest.
Audited, evidenced, current.
SOC 2 Type 2
Examination completed Q1 2026.
Report on request
CNCF Silver Member
Active since 2024.
Public listing
Linux Foundation
Member since 2024.
Public listing
OpenSSF Scorecard
Rolling out across our operator repos. Published per repo as coverage grows.
View on GitHub
Controls that live in the platform, not in a checklist.
mTLS everywhere
Istio service mesh on every workload cluster. Every pod-to-pod connection is mutually authenticated. Certificates rotated on schedule.
- Istio sidecar default-injected
- mTLS enforced via PeerAuthentication policy
- Cert rotation via cert-manager
Kyverno policy enforcement
Kyverno runs on every cluster with a curated best-practices policy set. Policies validate resource configs, security contexts, and image provenance.
- Audit mode default
- Enforce mode when you're ready
- Custom policies supported
RBAC scoped to the object model
Every API permission maps to a position in the Enterprise → Organization → Application hierarchy. Users get the smallest scope that matches their role.
- Object-model-aware RBAC
- Default-deny posture
- Per-environment isolation
Vault-backed secrets
All secrets (database credentials, API keys, cloud IAM tokens) flow through HashiCorp Vault. Secrets are never in Git. Rotation is scheduled and audited.
- Vault with Raft storage
- Per-cluster Vault instances available
- ExternalSecrets Operator integration
Audit logs to your SIEM
Every API call, every deploy, every policy decision is logged. Logs ship to your SIEM via OpenTelemetry or a direct webhook.
- OpenTelemetry-native
- Webhooks for Splunk, Datadog, Sentinel
- Configurable retention
We see what you let us see. Nothing more.
Ybor runs in your cloud accounts. We never store customer application data, customer secrets, or customer source code on Ybor-controlled infrastructure. The control plane manages platform state, not your business state.
// ybor sees
- Platform metadata: cluster status, deploy timestamps, object-model state
- Telemetry from platform operators
- Audit logs you choose to share
// ybor does not see
- Application data
- Customer secrets
- Source code
- Business records
How to request the report.
Sign a mutual NDA
We'll send the template. Most teams turn it around same-day.
Pick a period
Tell us which version: current reporting period or prior period.
Get the report
Delivered via the trust center portal within 1 business day.
Where our numbers come from.
The outcomes we cite on the home page are grounded in named customer engagements. Here's how each is measured.
Faster onboarding
Measured as median time for a new developer to a first running environment, before vs. after Ybor adoption. Sample: Ashley Furniture platform org, 2025.
Reduction in provisioning time
Time-to-environment across scaffolding and cloud-native setup, aggregated across engagements, 2025–2026.
Fewer manual setup tasks
Count of manual steps across cloning, cloud auth, and access requests, before vs. after the Ybor CLI. Source: aggregated customer data, 2025.
Cut in time-to-market
Aggregate across infrastructure, environments, and deployments. Source: Ashley Furniture internal benchmark, 2025.
Bring your security team.
We'll walk through our SOC 2 report, the policy library, and the audit-log story, and answer the questions you'd usually save for procurement.