# Protect your code and builds

Repository SBOMs, host-enforced egress rules, SAML SSO, audit log export and static IPs. Every CI job runs in its own ephemeral VM.

Security

Track dependencies, control network access and manage permissions, with isolated VMs for every CI job.

[Start free](https://console.avrea.com/)
[Talk to an engineer](https://avrea.com/demo)

[Trust & Security →](https://avrea.com/trust-security)

## Track the dependencies in every repository

Track production dependencies, versions and licenses with automatically updated SBOMs.

Spot copyleft and unknown licenses. Export CycloneDX, SPDX or JSON, and review previous scans by commit.

[Read the SBOM docs](https://docs.avrea.com/sbom/)

RepositorySBOM

 **Dependencies & licenses**

PackageVersionLicense

Linked to its source commit

CycloneDXSPDXJSON

## Outbound rules a job can’t switch off

Control where builds connect with organization and repository rules enforced outside the VM. See allowed and blocked connections for each job.

Required service connections stay allowed, including GitHub Actions, Avrea caches and Azure Blob Storage.

[Explore the egress firewall](https://docs.avrea.com/egress-firewall/)

### Egress firewall

- `registry.npmjs.org`Allow
- `registry.example.com`Allow
- Other destinationsDeny

### Give your CI a known IP address

Connect to IP-restricted databases and APIs using static outbound IPs reserved for your organization.

[Set up static IPs](https://docs.avrea.com/static-ip/)

## Company sign-in

Use SAML SSO with your identity provider’s MFA and access policies.

[SSO docs](https://docs.avrea.com/saml-sso/)

## Audit logs in your own storage

Track access and configuration changes. Export continuously to S3-compatible storage or Google Cloud Storage, with retention you control.

[Audit log docs](https://docs.avrea.com/audit-log-export/)

## Built into every CI job

### A new VM for every job

Every job gets its own VM, destroyed when the job ends.

### Repository-scoped caches

Caches are isolated by repository and encrypted in transit and at rest.

### Immutable cache entries

GitHub Actions cache entries cannot be overwritten. Integrity checks verify npm and Cargo packages.

### Repository access follows GitHub

Everyone, including admins, can only access repositories they can read on GitHub.

### Short-lived GitHub tokens

GitHub App tokens expire automatically. Targeted operations use only the repository permissions they need.

[GitHub App permissions](https://docs.avrea.com/github-permissions/)

## Access and integrations

### SSH access

Manage SSH access to running jobs, with repository permissions and an audit trail.

[SSH controls](https://docs.avrea.com/debugging/)

### Organization roles

Separate administration, billing and everyday access with organization roles.

[Roles and permissions](https://docs.avrea.com/organizations/)

### Session limits

Automatic session expiry and sign-out across all devices.

[Account security](https://docs.avrea.com/security/)

### Private networks

Connect runners to your private services through WireGuard, OpenVPN or Tailscale.

[Network rules and limits](https://docs.avrea.com/egress-firewall/)

### Logs in your own stack

Send job logs to your OpenTelemetry collector.

[Observability docs](https://docs.avrea.com/observability/)

ISO 27001:2022
certified

SOC 2 Type II
attested

[Trust & Security](https://avrea.com/trust-security)

## Protect your builds with Avrea

[Start free](https://console.avrea.com/)
[Talk to an engineer](https://avrea.com/demo)