Sonarcloud: encryption at rest and s3 buckets

SonarQube Cloud
1

Question regarding encryption at rest

We are interested in subscribing to sonarcloud, and have a detail question on “encryption at rest”.

The security docs say:
“We are sometimes asked if we implement encryption at rest on our servers; we do not. Storage encryption protects only against physical access to storage media. Considering the policies and controls in place in the Tier-4 data centers where SonarCloud is hosted, the value of using storage encryption on servers is extremely low. Encrypting at the database or the application level will impact the performance and the rich functionality provided by our service. That said, we do encrypt our S3 buckets using Server-Side Encryption with AWS S3-Managed Keys.”

Obviously there is some sort of storage encryption at rest: the s3 buckets. Now we’d like to know, which sort of data are you storing in the s3 buckets? Is it the source code? If yes, is the source code only stored in the s3 bucket? This is of importance for us, as we may avoid compliance issues, if the source code is encrypted at rest. Analysis protocols are regarded as less critical.

Thanks!
KDE

2

Hello Khalid,

Welcome to the community!

Just to clarify, we do not encrypt application data at rest in the database where the source-code is stored. We use S3 buckets for logs and other peripheral functions.

Kind regards,
Mark

3

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.