Security & Trust
Gastropod handles your software supply chain. This page states what is built and what runs today.
Your data stays isolated
Gastropod separates each tenant strictly: one organization per tenant, with its own datasets, keys, and quotas. Private packages, dependency graphs, and pull history remain within your tenant boundary; the system pools nothing across tenants. A self-hosted deployment keeps all data on your own network.
Encrypted in transit & at rest
Gastropod encrypts traffic with TLS and encrypts stored data at rest. Content addressing uses sha256, so the system verifies every blob against its own digest on ingest and on retrieval.
Access control, every tier
OIDC-based SSO ships on every plan. Role-based access (admin, publisher, reader) and narrowly scoped API tokens let you control both people and machine accounts.
Integrity & provenance
Gastropod checks every pull against the authoritative source for its ecosystem. The system flags identity drift and tampered artifacts before you pull them.
An exportable audit spine
Gastropod records who did every pull: what they pulled, from where, and when. The system rebuilds a CycloneDX SBOM on demand from that record, and you can query or export it at any time.