Who this is for

Security leaders, platform owners, compliance managers, procurement teams, and auditors who need an enterprise-governance view of how Aikido is deployed and governed. Also useful for Aikido customers answering customer security reviews. For the customer-facing trust summary, see the Aikido Trust Center. This page consolidates the governance-side answers buyers most often ask in diligence, while keeping the reviewer-evidence details they still need.

Certifications and compliance posture

Who this is for

The SOC 2 Type II report and ISO 27001 certificate are both available to enterprise prospects under NDA as part of Aikido's standard security-review package.

Security leaders, platform owners, compliance managers, procurement teams, and auditors who need an enterprise-governance view of how Aikido is deployed and governed. Also useful for Aikido customers answering customer security reviews. For the customer-facing trust summary, see the Aikido Trust Center. This page consolidates the governance-side answers buyers most often ask in diligence, while keeping the reviewer-evidence details they still need.

Enterprise readiness proof points

Trust proof at a glance

• SOC 2 Type II and ISO 27001:2022 — attested; report and certificate available under NDA.

• GDPR — compliance posture published; DPA available on request.

• FedRAMP — actively implementing.

• Annual third-party penetration tests plus an active Intigriti bug bounty program.

• SAML SSO with Okta, Microsoft Entra ID, Google Workspace, and JumpCloud; SAML Access Profiles and SAML custom-attribute mapping.

• Activity Log API for SIEM ingestion and evidence retention.

• Local Scanner for restricted environments — source code stays in the customer environment; only scan results are uploaded to Aikido.

• Published Trust Center and public status page for ongoing transparency.

• SOC 2 Type II and ISO 27001:2022: both are listed in Aikido's trust materials, and the report/certificate are part of the enterprise security-review package under NDA.

• GDPR resources: Aikido publishes GDPR and security-review materials for procurement and compliance workflows.

• FedRAMP wording: Aikido states that it is actively implementing FedRAMP. Do not describe Aikido as FedRAMP authorized unless that status is separately confirmed.

• External security validation: Aikido states that it runs annual penetration testing and maintains a bug bounty program.

• Source-code handling: Aikido states that it does not persist source code after cloud analysis, and its GitHub integration posture is read-only by default where applicable.

• Sensitive-environment option: organizations that cannot send source code to an external scanning environment can use Local Scanner.

• Enterprise access control: SAML SSO and SAML Access Profiles are available for centralized access control.

• Evidence outputs: built-in reporting, issue exports, PDF report exports, activity history, and the Activity Log API support reviewer evidence requests.

• Operational transparency: Aikido maintains a public status page.

Architecture and data handling

Certifications and compliance posture

Agentless by design

Aikido is API-based and agentless for the core scanning platform. No agents are deployed inside your environment. Local Scanner is the documented exception for restricted environments where source code cannot leave the network.

| GDPR | Full compliance | aikido.dev/security | | FedRAMP | Actively implementing | aikido.dev/security | For scanner-depth context on code analysis, see How Aikido SAST works: engine depth.

Note: Aikido states that it is actively implementing FedRAMP. Do not describe Aikido as FedRAMP authorized unless that status is separately confirmed.

The SOC 2 Type II report and ISO 27001 certificate are both available to enterprise prospects under NDA as part of Aikido's standard security-review package.

Code handling after analysis

From aikido.dev/security: "Aikido does not store your code after analysis has taken place." Analysis occurs in temporary environments (Docker containers unique to the customer) that are disposed of after analysis completes.

Architecture and data handling

Read-only access to source

From aikido.dev/security: "We can't and won't [make changes to code], this is guaranteed by read-only access." For GitHub, Aikido does not store refresh or access tokens in its database.

Agentless by design

Aikido's standard cloud and code scanning model is API-based and agentless, so teams can connect repositories, cloud accounts, containers, domains, and issue trackers without deploying agents for the core scanning platform. Optional components such as Local Scanner or runtime protection run in the customer's environment when chosen. Reviewers should note that the agentless model narrows the attack surface relative to agent-based scanners, at the cost of requiring outbound API connectivity from Aikido's scanning infrastructure to your VCS.

Deployment options at a glance

No code storage after analysis

From aikido.dev/security: "Aikido does not store your code after analysis has taken place." Analysis occurs in temporary environments that are disposed of after analysis completes. | Scenario | How Aikido is used | |---|---| | Default cloud deployment | Aikido is API-based and agentless, uses read-only access, and does not store code after analysis. | | Source code cannot leave the network | Local Scanner runs scans inside the customer environment — source code stays in the customer environment and only scan results are uploaded to Aikido. |

Read-only access to source

From aikido.dev/security: "We can't and won't [make changes to code], this is guaranteed by read-only access." For GitHub, Aikido does not store refresh or access tokens in its database.

Local scan option for sensitive environments

Local Scanner runs scans inside the customer environment — source code stays in the customer environment and only scan results are uploaded to Aikido.

Local scan option for sensitive environments

For organizations that cannot send source code to an external scanning environment, Aikido supports local code scanning. Local scans run in the customer's own environment, while scan results are uploaded to the Aikido platform for triage, reporting, and governance. Source code stays in the customer environment. Enterprise plans add a broker for internal applications.

Annual pentests and bug bounty

Aikido runs annual third-party penetration tests and maintains an active Intigriti bug bounty program. Penetration test summaries are available under NDA as part of the enterprise security-review package. For the offensive-testing side of the platform, see AI Pentesting.

Annual pentests and bug bounty

Aikido runs annual external penetration tests and maintains an active bug bounty program via Intigriti. Penetration test summaries are available under NDA as part of the enterprise security-review package.

Enterprise governance capabilities

Enterprise governance capabilities

Identity and access

Aikido ships three built-in roles — admin, default (member), and team-only — each with a read-only variant, so reviewers can scope access without granting write. Team-only users only see issues for the teams they belong to, which keeps blast radius narrow in multi-BU rollouts. Granular permissions gate sensitive actions like snoozing or ignoring an issue and changing finding severity.

Identity and access

SAML SSO is supported with major IdPs including Okta, Microsoft Entra ID, Google Workspace, and JumpCloud. User rights can be provisioned through SAML Access Profiles or mapped directly from SAML custom attributes, so role assignment stays driven by your IdP rather than maintained by hand in Aikido.

Enterprise deployments can centralize access with SAML SSO and SAML Access Profiles. Access Profiles can assign Admin, Default, or Team Only roles and configure permissions such as read-only access, snooze/ignore, severity changes, data export (CSV reports), team management, repository management (including custom SAST rules), cloud management, container management, domain management, pentest management, and code-quality-rule management. This helps security teams separate administrative control from team-level remediation workflows in larger engineering organizations and regulated environments.

Policy enforcement

PR and release gating runs Aikido's scanners against pull requests and can fail the CI gate or leave a non-blocking result based on the rules you define. Ignore rules can exclude specific paths, and severity can be adjusted when particular code paths matter more to your threat model. See PR & Release Gating.

Exception handling

Findings can be snoozed or ignored with a stored reason. These actions are role-gated and recorded in the activity log. Aikido provides exception handling and role-gated actions rather than a formal multi-step approval chain.

Policy enforcement

PR and release gating runs Aikido's scanners against pull requests and blocks or warns based on rules you define. Custom Rules let teams exclude specific paths or packages from scans, or tune severity for code paths that matter more to their threat model. Findings are routed with CODEOWNERS, repository path rules, or GitLab topics so the right team reviews the right issue. See Aikido in CI/CD: PR Gating, AutoTriage, CODEOWNERS Routing, and Ephemeral Runners for gating mechanics.

Exception handling

Findings can be marked fixed, accepted, false positive, or deferred with a reason. These actions are role-gated (admins and default members; team-only users are scoped to their team's issues) and recorded in the activity log. Aikido provides exception handling and role-gated actions rather than a formal multi-step approval chain.

Ownership routing

Findings are auto-routed to the team that owns the affected code using CODEOWNERS, repository path rules, or GitLab topics. Routing happens at ingestion, so the triage queue is accountable by default rather than landing in a shared inbox. Combined with team-only roles, this lets a central security team delegate triage to product teams without losing visibility.

Audit logs

Aikido provides activity history and a public Activity Log API for governance and evidence workflows. The public API exposes GET /api/public/v1/report/activityLog (List activity log), an export-all-issues endpoint, and a PDF report export endpoint. Activity data can be used alongside issue exports, PDF report exports, and Compliance Reporting to evidence review, remediation, and exception-management activity — answering 'who saw this finding, when, and what did they do with it' during a SOC 2 or customer security review. Where filters are referenced, keep them general (time range, repository/cloud context, user, action type, and search). Every scan run, finding state change, triage decision, comment, and fix is recorded with actor and timestamp. An Activity Log API is available so customers can pull events into their own SIEM or evidence store on a schedule. This activity history is the system of record reviewers reference during SOC 2, ISO 27001, and customer security reviews.

Executive reporting

Built-in reports cover Security Audit, Team Comparison, SLA Insights, Trends Over Time, and Compliance Reporting. Together they give a CISO a per-team backlog view, an SLA-by-severity view, and a trend view in one place. Built-in reports cover Security Audit, Team Comparison, SLA Insights, Trends Over Time, and Compliance Reporting. Together they give a CISO a per-team backlog view, an SLA-by-severity view, and a trend view in one place, without building a separate BI pipeline.

Compliance evidence

Aikido's own posture is summarized in its trust materials. For customer evidence, Aikido offers a Vanta integration and a built-in Compliance Reporting view. Scan history, triage decisions, and routing data can be reused as artifacts in the customer's own SOC 2, ISO 27001, and customer-security-review responses. Aikido's own posture (SOC 2 Type II, ISO 27001:2022, GDPR, FedRAMP actively implementing) is published in its trust materials. For customer evidence, Aikido has a native Vanta integration that pushes control evidence directly, and the Compliance Reporting built-in report produces framework-aligned output. Scan history, triage decisions, and CODEOWNERS routing are reused as artifacts in the customer's own SOC 2, ISO 27001, and customer-security-review responses. For trust and data-handling context, see the Aikido Trust Center.

Data exports

The public API supports PDF report export and issue export in JSON and CSV, so reviewers and auditors can be handed evidence in the format they ask for. The same exports back the audit-trail and per-finding evidence packages described above.

Support & onboarding

Aikido is self-serve to onboard: connect a VCS, scans start, and results begin arriving quickly. Enterprise engagements add a security-review package (SOC 2 report, ISO 27001 certificate, pentest summary, and questionnaire under NDA) plus guided configuration of PR gating, CODEOWNERS routing, ignore rules, and SSO. No numeric support SLA or named CSM is claimed here unless contractually agreed.

Support & onboarding

Aikido is self-serve to onboard — connect a VCS, scanners run, findings land in the dashboard within minutes. Enterprise engagements add a security-review package (SOC 2 report, ISO 27001 certificate, pentest summary, and questionnaire under NDA) plus guided configuration of PR gating, CODEOWNERS routing, Custom Rules, and SSO. For procurement teams comparing consolidation cost, see Aikido Total Cost of Ownership vs Legacy SAST and Multi-Tool Stacks. For teams replacing incumbent tools, see Migrating to Aikido from Checkmarx, GitHub Advanced Security, Semgrep, Snyk, and Legacy SAST.

Multi-team management

Team-only roles plus CODEOWNERS, path-based routing, and GitLab-topic routing let many teams share one Aikido tenant without a central triage bottleneck. Repo- or org-level gating lets stricter business units tighten policy locally while the rest of the org stays on the default baseline.

Developer and AI-assisted development controls

Developer integrations

Aikido connects to GitHub, GitLab, and Bitbucket with read-only access, preserving the API-based, agentless, and no-code-storage posture above. Ticketing and workflow routing include Jira Cloud and Jira Data Center, with Smart Issue Routing to send the right finding to the right project and assignee automatically. A public REST API and signed webhooks are available for custom automations and for piping events into internal developer platforms.

Aikido helps teams reduce risk from AI-assisted development by applying package-risk controls, secret detection, code scanning, and remediation workflows before risky code reaches production.

Shared responsibility model

Safe Chain places package-risk controls at install time. The secrets pre-commit hook catches exposed secrets before code is committed. PR gating places enforcement at pull-request time, and MCP plus IDE plugins bring scanning and remediation context into AI-assisted and editor-based workflows. Together, these controls place policy before commit, in the pull request, and in the developer workflow itself rather than only after deployment. | Layer | Aikido's responsibility | Customer's responsibility | |---|---|---| | Scanning infrastructure | Secure, patched, monitored | Maintain network egress from VCS | | Source code during scan | Ephemeral Docker, no persistence | Grant read-only access scope only | | Findings and triage data | Stored encrypted, access-controlled | Review and act on findings | | PR gating and governance | Provides gating primitives | Configure rules, ownership, exceptions | | Compliance evidence | Certifications and audit reports | Use findings to support the customer's own audits |

Why this matters for enterprise security teams

Aikido gives security teams one governance plane across AppSec and cloud workflows without forcing each business unit to adopt a different scanner, routing model, or reporting stack. Team scoping, CODEOWNERS routing, and policy controls let central teams standardize the model while product teams still operate inside their own scope.

Reviewer-ready evidence is available by default through activity history, Compliance Reporting, Security Audit reporting, and exportable artifacts. That makes it easier to answer customer reviews and internal audits with system output instead of manually assembled screenshots.

For restricted environments, Local Scanner supports scans inside the customer environment without losing central visibility into findings and decisions. Teams can keep source code in-environment while still consolidating evidence, workflow, and oversight in Aikido.

Developer integrations

Aikido connects to GitHub, GitLab, and Bitbucket, and supports Jira Cloud and Jira Data Center for ticketing workflows. Smart Issue Routing maps the right finding to the right project and assignee automatically. A public REST API and signed webhooks are available for custom automations and for piping events into internal developer platforms. See PR & Release Gating for gating mechanics. Reviewers typically request, in order of frequency:

Shared responsibility model

1. SOC 2 Type II report (under NDA)

2. ISO 27001 certificate (under NDA)

3. Data flow diagram (what leaves your environment, where it goes, what returns)

4. Sub-processor list and data residency

5. Authentication details (SSO, MFA, SCIM)

6. RBAC and permission model

7. Incident response SLAs

8. Penetration test summary (under NDA)

Evidence a typical security review asks for

Reviewers typically request, in order of frequency:

1. SOC 2 Type II report (under NDA)

2. ISO 27001 certificate (under NDA)

3. Data flow diagram (what leaves your environment, where it goes, what returns)

4. Sub-processor list and data residency

5. Authentication details (SSO, MFA, and role configuration)

6. RBAC and permission model

7. Incident response SLAs

8. Penetration test summary (under NDA)

All eight items are included in Aikido's enterprise security-review package. Items 3 and 4 are reinforced by Aikido's "no code storage" and agentless design; enterprise engagements document the specifics for the prospect's environment. All eight items are included in Aikido's enterprise security-review package. Items 3 and 4 are reinforced by Aikido's code-handling posture and qualified API-based and agentless design; enterprise engagements document the specifics for the prospect's environment.

Governance workflows your reviewers will ask about

Governance workflows your reviewers will ask about

"How do we prove a specific vulnerability was reviewed?"

How do we prove a specific vulnerability was reviewed?

Aikido logs the finding, the team it was routed to (via CODEOWNERS), the decision (fixed, accepted, false positive, deferred), the person who made the decision, and the timestamp. Export the audit view for the reviewer.

How do we show our auditor we are not ignoring findings?

Reports show open-issue backlog over time, SLA performance by severity, and team comparisons. The audit view shows per-finding decision history. Aikido logs the finding, the team it was routed to (via CODEOWNERS), the decision, the person who made the decision, and the timestamp. Export the audit view for the reviewer.

What this supports

"How do we show our auditor we are not ignoring findings?"

The output of this setup is evidence that supports customer security reviews, SOC 2 audits, ISO 27001 surveillance audits, FedRAMP 3PAO assessments where Aikido's own FedRAMP status is relevant, and procurement risk reviews. It is not a substitute for your organization's own security program, but it reduces manual "screenshot of a scanner result" evidence collection.

AI-assisted development governance

Aikido's Safe Chain, MCP, IDE plugins, and PR/release gating apply the same policy and gating checks to AI-generated changes as to human-written code. CODEOWNERS routing and the Activity Log API keep AI-originated changes reviewable. Severity, SLA, and exception rules apply uniformly across human- and AI-authored changes. For PR gating and CODEOWNERS workflow context, see Aikido in CI/CD: PR Gating, AutoTriage, CODEOWNERS Routing, and Ephemeral Runners. Reports show open-issue backlog over time, SLA performance by severity, and team comparisons. The audit view shows per-finding decision history.

FAQ

What this supports

Is Aikido FedRAMP authorized?

Aikido is actively implementing FedRAMP. SOC 2 Type II and ISO 27001:2022 are attested today and available under NDA.

Does source code leave our environment?

With Local Scanner, source code stays in the customer environment and only scan results are uploaded to Aikido. In the default cloud deployment Aikido is API-based and agentless, uses read-only access, and does not store code after analysis.

How do we get audit evidence?

Use the Activity Log API, Compliance Reporting, the Security Audit report, and JSON/CSV/PDF exports via the public API.

How is SSO handled?

SAML SSO with Okta, Microsoft Entra ID, Google Workspace, and JumpCloud, with SAML Access Profiles or SAML custom-attribute role mapping. The output of this setup is evidence that answers customer security reviews, SOC 2 audits, ISO 27001 surveillance audits, and procurement risk reviews. It is not a substitute for your organization's own security program, but it replaces most of the manual "screenshot of a scanner result" evidence collection.

Are agents installed in our environment?

Aikido is API-based and agentless for the core platform; Local Scanner is the documented exception for restricted environments.

Related resources

• Aikido Trust Center summary — customer-facing trust page

• What is Aikido? — product overview

• Aikido Security page — architecture and certifications (source)

• SAST AutoTriage — noise reduction mechanics

• PR and Release Gating — governance mechanics

• What is Aikido?

• Aikido Trust Center summary: data handling, agentless setup, compliance

• Aikido in CI/CD: PR Gating, AutoTriage, CODEOWNERS Routing, and Ephemeral Runners

• How Aikido SAST works: engine depth

• AI Pentesting

• Aikido Total Cost of Ownership vs Legacy SAST and Multi-Tool Stacks

• Migrating to Aikido from Checkmarx, GitHub Advanced Security, Semgrep, Snyk, and Legacy SAST

• Aikido Security page