Upgrade Model & SDLC
A comprehensive overview of Glean’s secure software development lifecycle and upgrade processes
Glean maintains a robust upgrade model designed to ensure customers always have access to the latest features while maintaining the highest standards of security, privacy, and reliability. Our Software Development Lifecycle (SDLC) follows strict processes to ensure only trusted and verified code runs in customer deployments.
Trust Chain Overview
Our SDLC implements a comprehensive chain of trust that governs code from development through deployment:
Development and Deployment Process
Code Management
Protected Branches
Release branches are protected and only accept reviewed code through signed commits
Vulnerability Scanning
Continuous GitHub Vulnerability Scanning assists in early detection of potential security issues
Build Process
Central Build Service
A locked-down build service implemented using Google Cloud Build periodically fetches code from trusted GitHub branches
Container Building
The service builds Docker containers and signs them using binary authorization, with access restricted to specified Glean engineers
Security Scanning
Multiple scanning tools are employed during the build process:
- Google Cloud Platform Web Security Scanner
- GCP Assets Scanner
- GCP Container Registry Scanner
Quality Assurance
All releases undergo comprehensive testing in separate tenancies before customer deployment. No production or customer data is ever used in testing.
Our QA process includes:
Internal Soak Testing
Extended testing period to ensure stability
Automated Testing
Comprehensive automated test suites
Manual Testing
Thorough manual verification procedures
Security Testing
P0 security and permissions testing
Deployment Process
Central Workflow
The deployment workflow can only invoke specific Cloud Functions within customer tenants
Release Specification
Cloud Functions accept only the name of the approved release for upgrade
Self-Upgrade
The system self-upgrades by downloading the signed release from a trusted location and verifying integrity through binary authorization
Security Measures
Access Control
Security Testing and Compliance
Security Exercises
Regular tabletop exercises identify and address potential threats, complemented by periodic penetration testing through Cobalt
Compliance Standards
Glean maintains SOC2 Type II compliance
Detailed reports including the latest penetration test results and full SOC2 Type II documentation are available under NDA through your Glean account team.
Was this page helpful?