Glean maintains a robust upgrade model designed to ensure customers always have access to the latest features while maintaining the highest standards of security, privacy, and reliability. Our Software Development Lifecycle (SDLC) follows strict processes to ensure only trusted and verified code runs in customer deployments.

​
Trust Chain Overview

Our SDLC implements a comprehensive chain of trust that governs code from development through deployment:

​
Development and Deployment Process

​
Code Management

Protected Branches

Release branches are protected and only accept reviewed code through signed commits

Vulnerability Scanning

Continuous GitHub Vulnerability Scanning assists in early detection of potential security issues

​
Build Process

1

Central Build Service

A locked-down build service implemented using Google Cloud Build periodically fetches code from trusted GitHub branches
2

Container Building

The service builds Docker containers and signs them using binary authorization, with access restricted to specified Glean engineers
3

Security Scanning

Multiple scanning tools are employed during the build process:
  • Google Cloud Platform Web Security Scanner
  • GCP Assets Scanner
  • GCP Container Registry Scanner

​
Quality Assurance

All releases undergo comprehensive testing in separate tenancies before customer deployment. No production or customer data is ever used in testing.
Our QA process includes:

Internal Soak Testing

Extended testing period to ensure stability

Automated Testing

Comprehensive automated test suites

Manual Testing

Thorough manual verification procedures

Security Testing

P0 security and permissions testing

​
Deployment Process

1

Central Workflow

The deployment workflow can only invoke specific Cloud Functions within customer tenants
2

Release Specification

Cloud Functions accept only the name of the approved release for upgrade
3

Self-Upgrade

The system self-upgrades by downloading the signed release from a trusted location and verifying integrity through binary authorization

​
Security Measures

​
Access Control

​
Security Testing and Compliance

Security Exercises

Regular tabletop exercises identify and address potential threats, complemented by periodic penetration testing through Cobalt

Compliance Standards

Glean maintains SOC2 Type II compliance
Detailed reports including the latest penetration test results and full SOC2 Type II documentation are available under NDA through your Glean account team.