Security

»Security at HashiCorp

We know our users place a high level of trust in HashiCorp and the products we make to manage mission critical infrastructure. The security of customer data, of our products, and our services are a top priority. HashiCorp’s best-in-class security starts at the foundational level and includes internal threat models, routine internal and external security assessments, and secure software development.

»Security team

HashiCorp has a fully staffed team of security professionals dedicated to securing, protecting and improving the security posture of the company and its products. The broader security team consists of:

• Detection & Response

• Cloud Security

• Product Security

• Corporate Information Security

• Red Team, and

• Governance, Risk and Compliance (GRC).

»Compliance program

We have a team dedicated to our compliance program and are committed to providing our customers with all relevant security documentation to build a foundation of trust in our company and products. Currently, we have a SOC 2 Type 2 report, ISO 27001, ISO 27017 and ISO 27018 certifications covering the following Products:

• Enterprise Products

  • Terraform

  • Vault

  • Consul

  • Nomad

  • Boundary

• Cloud Products

  • HashiCorp Cloud Platform (HCP)

  • HCP Terraform

  • HCP Boundary

  • HCP Packer

  • HCP Vault Dedicated

  • HCP Consul Dedicated

  • HCP Vault Secrets

  • HCP Vault Radar

  • HCP Waypoint

View certificates and reports

If you have any additional questions around our security program, please email customertrust@hashicorp.com

»Penetration tests

HashiCorp hires external, reputable third parties to perform regular security assessment and penetration testing of our products. Enterprise customers can email customertrust@hashicorp.com to request extracts from these reports.

»Privacy

HashiCorp respects your privacy and is committed to protecting your Personal Information (any information that relates to an identified or identifiable individual). Our belief is that any Personal Information provided to us by you is just that: personal and private.

We do not rent, sell or trade your Personal Information.

Our full privacy policy is available at https://www.hashicorp.com/privacy. To submit a data subject request please visit privacy.hashicorp.com. For any privacy related questions, please email privacy@hashicorp.com.

»Abuse

HashiCorp takes all abuse complaints seriously and can assist in investigation of abuse associated with HashiCorp-managed services.

Information regarding how to report abuse is available at https://www.hashicorp.com/abuse.

The Acceptable Use Policy can be found at https://www.hashicorp.com/trust/security/aup.

»PGP public key

HashiCorp’s current PGP public key can be fetched from Keybase or from most keyservers with the key ID 72D7468F and fingerprint C874 011F 0AB4 0511 0D02 1055 3436 5D94 72D7 468F. It is also available at https://www.hashicorp.com/.well-known/pgp-key.txt.

»Secure communications

The current PGP public key referenced above can be used to encrypt email to security@hashicorp.com.

»Release archive checksum verification

If you would like to verify the checksum of a HashiCorp product download (specifically, an archive from https://releases.hashicorp.com), please note that only the SHA256SUM file is signed by the PGP key above. The archives themselves are not signed, but rather hashed. To verify the integrity of a particular archive:

• Download the archive, SHA256SUM, and SHA256SUM.sig files (multiple .sig files may be present, named with the associated signing PGP key ID)

• Verify the SHA256SUM file is properly signed

• Verify the SHA256SUM in the file matches the archive

For example: