Communication with your VCS to access source code is always encrypted over the wire using SSH and/or HTTPS.

Enforce organizational compliance and standardization across projects.

Environment variables (secrets)

Protect secrets and other sensitive data in CircleCI using environment variables.

CircleCI supports authentication via OpenID Connect at the job level. Using OIDC, pipelines can authenticate to systems like Vault, AWS and GCP without distributing secrets.

Restricted contexts allow encrypted storage and sharing of environment variables across multiple projects while limiting access to certain user groups or at the project level.

Use audit logs to monitor anomalies, assist in forensics, and demonstrate compliance.

CircleCI runs all builds in isolated sandboxes that are destroyed after each use.

Console output and artifacts

Encryption is employed over the wire using SSH and/or HTTPS for both console output and artifacts. Both are only available to those with read access to your repository.