Trust Chain Overview
Our SDLC implements a comprehensive chain of trust that governs code from development through deployment:Development and Deployment Process
Code Management
Protected Branches
Release branches are protected and only accept reviewed code through signed commits
Vulnerability Scanning
Continuous GitHub Vulnerability Scanning assists in early detection of potential security issues
Build Process
1
Central Build Service
A locked-down build service implemented using Google Cloud Build periodically fetches code from trusted GitHub branches
2
Container Building
The service builds Docker containers and signs them using binary authorization, with access restricted to specified Glean engineers
3
Security Scanning
Multiple scanning tools are employed during the build process:
- Google Cloud Platform Web Security Scanner
- GCP Assets Scanner
- GCP Container Registry Scanner
Quality Assurance
All releases undergo comprehensive testing in separate tenancies before customer deployment. No production or customer data is ever used in testing.
Internal Soak Testing
Extended testing period to ensure stability
Automated Testing
Comprehensive automated test suites
Manual Testing
Thorough manual verification procedures
Security Testing
P0 security and permissions testing
Deployment Process
1
Central Workflow
The deployment workflow can only invoke specific Cloud Functions within customer tenants
2
Release Specification
Cloud Functions accept only the name of the approved release for upgrade
3
Self-Upgrade
The system self-upgrades by downloading the signed release from a trusted location and verifying integrity through binary authorization
Security Measures
Access Control
Employee Authentication
Employee Authentication
Glean implements:
- Single Sign-On (SSO) with Multi-Factor Authentication (MFA)
- 24-hour authentication sessions
- Mandatory re-authentication after session expiry
Repository Access
Repository Access
Access controls include:
- Limited engineer access to private GitHub repositories
- Restricted IAM permissions for build triggers
- Separation of build trigger and pipeline modification permissions
Security Testing and Compliance
Security Exercises
Regular tabletop exercises identify and address potential threats, complemented by periodic penetration testing through Cobalt
Compliance Standards
Glean maintains SOC2 Type II compliance
Detailed reports including the latest penetration test results and full SOC2 Type II documentation are available under NDA through your Glean account team.