# Security and Compliance

Your auditor wants proof that every change was reviewed, approved and logged. Bumpkit records that proof as your team ships. This page maps Bumpkit's features to the controls they produce evidence for, for security, compliance and GRC teams.

Bumpkit provides evidence for these controls. It doesn't make you compliant: your auditor assesses your controls, and Bumpkit's records are one input. This page describes evidence for your audit, not an attestation of Bumpkit itself.

## The features behind the evidence

| Feature | What it records | Where to get it |
|---|---|---|
| [Release gate](/docs/release-gate) | Every gate decision: outcome, the rules that fired and why, the policy hash in force | Release page, [evidence export](/docs/compliance#evidence-export) |
| [Approvals](/docs/approvals) | Who approved each change, from GitHub reviews, Slack, the dashboard or the CLI; the author's own vote never counts | Gate decision, audit log, evidence export |
| [Break-glass overrides](/docs/hotfixes) | Who overrode which commit, why, and the post-hoc review | `emergency_changes` in the evidence export |
| [Authorship with confidence](/docs/release-gate#who-wrote-the-change) | Who committed each change and who wrote it, a person or a coding agent, with the signals behind it and a confidence measured on verified releases | Release page, [governance evidence](/docs/compliance#agent-governance-evidence) |
| [Agent telemetry](/docs/agent-telemetry) | Verified agent sessions matched to commits and pull requests, plus every telemetry setting change | Release page, audit log |
| [Audit log](/docs/compliance#audit-log) | Every change to settings, keys, team, roles, policies, approvals and overrides, with who made it and from where | Dashboard, `bumpkit audit`, audit export |
| [Audit streaming](/docs/compliance#audit-streaming) | The same events, live, in Splunk, Datadog, S3 or a signed webhook | Your SIEM |
| [Signed evidence](/docs/compliance#signed-evidence) | A tamper-evident, signed bundle you verify offline | `bumpkit evidence export --signed` |
| [Auditor access](/docs/compliance#auditor-access) | Read-only, expiring links for your auditor, with every visit logged | Settings |
| [Roles and SSO](/docs/sso) | Who can approve, override, change policy and export evidence | Settings, audit log |

## SOC 2 Trust Services Criteria

| Criterion | What the control asks | Evidence from Bumpkit |
|---|---|---|
| CC8.1 Change management | Changes are authorized, designed, tested, approved and implemented under a defined process | Gate decisions for every release check with the rules and policy hash in force; approvals with the approver and source; break-glass overrides with reason and post-hoc review; authorship with measured confidence; [governance evidence](/docs/compliance#agent-governance-evidence) flagging agent changes that skipped required review |
| CC6.1 Logical access | Access to systems and data is restricted to authorized users | [Roles](/docs/sso#roles) that limit who approves, overrides and exports; SSO and SCIM; the author's vote never counts; audit events for role changes, key creation and refused exports (`evidence.export.denied`, `audit.read.denied`); telemetry ingest keys stored as hashes, with expiry, revocation and optional IP allowlists |
| CC7.2 Monitoring | System components are monitored for anomalies that indicate malicious acts or errors | Audit log streamed to your SIEM; `gate.merged_without_approval` when a pull request merges past a pending approval; overdue override reviews; telemetry alerts for unused keys, requests from outside an allowlist and rejection spikes |

## ISO/IEC 27001:2022 Annex A

| Control | What the control asks | Evidence from Bumpkit |
|---|---|---|
| A.8.32 Change management | Changes to information processing facilities and systems follow change management procedures | Your `bumpkit.yml` policy as the documented procedure, versioned and recorded on each decision; gate decisions, approvals and overrides per change; release batches with their approvers |
| A.8.15 Logging | Logs of activities, exceptions and other relevant events are produced, stored, protected and analyzed | The audit log; tamper-evident, signed evidence exports; signed audit event exports; streaming to your SIEM for analysis and retention on your side |

## Pull evidence for an audit period

```bash
bumpkit evidence export --signed --from 2026-01-01 --to 2026-12-31 -o evidence.zip
bumpkit evidence verify evidence.zip --public-key-file bumpkit-key.json
bumpkit evidence governance --days 365 --format csv -o governance.csv
bumpkit audit export --from 2026-01-01 --to 2026-01-31 --format jsonl -o january-audit.jsonl
```

Or create an [auditor link](/docs/compliance#auditor-access) and let your auditor download it all. See [Compliance Evidence](/docs/compliance) for every field.

## Data flow

| From | To | What moves | What Bumpkit keeps |
|---|---|---|---|
| GitHub, through the GitHub App | Bumpkit | Pull request, commit and review events; diffs fetched to run checks | Results, findings and gate decisions. Never the diff. See [Data Handling](/docs/data-handling#what-bumpkit-stores). |
| CLI, CI and the MCP server | Bumpkit | The diff and commit metadata for a check, authenticated with your API key | Same as above |
| Bumpkit | The AI provider | Commit subjects, finding titles and a capped diff excerpt, for explanations only. Blocking decisions never use AI. | Provider, model and token counts. See [What is sent to the AI provider](/docs/data-handling#what-is-sent-to-the-ai-provider) and [Zero retention](/docs/data-handling#zero-retention). |
| Claude Code on developer machines | Bumpkit's OTLP endpoint | OpenTelemetry usage events, signed with an ingest key | Raw events for 1, 7 or 30 days; matches with the release check. Never prompts or code. See [Agent Telemetry](/docs/agent-telemetry#data). |
| Bumpkit | Slack, GitHub | Approval requests, check results and pull request comments | Delivery records |
| Bumpkit | Your SIEM or storage | Audit events through [audit streaming](/docs/compliance#audit-streaming) | Nothing extra |
| Bumpkit | Your auditor | Evidence and audit exports through an auditor link | A log of every visit and download |

Destination secrets are encrypted with AES-256-GCM before they're stored. API keys and telemetry ingest keys are stored as hashes. See [Credentials and secrets](/docs/data-handling#credentials-and-secrets).

## Telemetry controls

Agent telemetry is off until an owner or admin turns it on. Then:

- It starts in **Observe only** and never affects the gate until an admin switches it.
- Only owners and admins change it, and every change is audit-logged and streamed.
- Raw events are kept 1, 7 or 30 days, and **Purge now** deletes them at once.
- Email is hashed by default, or kept or dropped.
- Prompts and code are never stored.

See [Agent Telemetry](/docs/agent-telemetry).