Your accounts. Your code. No standing access.
We build environments that hold up to a security review, so it would be strange to be casual about our own access to them. Here is exactly how it works.
The short version
BuiltForProd deploys into cloud accounts you own, using repositories in your own organization, and keeps no standing access after handover. There is no principal, role or credential belonging to us left in your environment, and nothing in the delivered code names BuiltForProd. If you later buy Managed, our engineers work through groups you create in your own identity provider and can remove in a single change.
The design goes further than that: in the AWS Enterprise Baseline, no long-lived cloud credential exists for anyone. Not for your engineers, not for your pipeline, not for us.
No long-lived credentials
The most common cloud breach path is a key that should not have existed. So none does.
IAM users are denied by policy
A service control policy denies creating IAM users and access keys across the organization. It is not a convention or a lint rule: the request is refused, including for administrators.
People sign in through single sign-on
IAM Identity Center with 12-hour sessions and 11 permission sets. Multi-factor authentication is required by policy, and an analyzer flags permissions nobody has used in 90 days.
The pipeline federates with OIDC
GitHub Actions assumes a role through OIDC federation. No AWS key is stored in version control, because there is no AWS key to store.
Secrets never sit in plaintext
Where the Secrets Blueprint is deployed, values are encrypted under a KMS key per stage and delivered to workloads by the platform, never by a person.
Ownership, precisely
Created under your management account, owned by your organization and billed to you by your cloud provider. The root mailbox is yours and stays yours.
Created in your own version control organization as forks of the upstream BuiltForProd repositories, so later improvements arrive as pull requests you review rather than as changes you receive.
Source-available under the PolyForm Internal Use License 1.0.0: your organization can deploy, modify, fork and extend the code internally. It is not open source, and it is built on open-source tooling — OpenTofu, Terragrunt, Kubernetes, ArgoCD.
Your data stays in your accounts. BuiltForProd does not host, process or replicate customer workload data, and there is no BuiltForProd control plane for your environment to call.
Deployment access is removed as part of the sign-off checklist, along with the bootstrap identity used to create the organization. The checklist is not complete until it is.
What the environment detects
Delivered controls, not a monitoring service we operate on your behalf.
| Control | What it does |
|---|---|
| CloudTrail | Organization-wide and multi-region, with log file validation, landing in a separate audit account. A policy prevents stopping or deleting it. |
| AWS Config | In every account, with an organization aggregator and conformance packs evaluating resources continuously. |
| GuardDuty | Threat detection covering S3, EKS audit logs and EBS malware scanning, with higher-severity findings routed to alerts. |
| Security Hub | Central findings aggregation, with four standards available to switch on. |
| IAM Access Analyzer | External access findings, plus unused access detection at 90 days. |
| Firewall Manager and WAF | WAF on every workload load balancer, with managed rule groups and automatic remediation of gaps. |
| CIS alarms | Seven CloudWatch alarms, from root account use to IAM policy, CloudTrail, S3 policy and VPC changes. |
| Drift detection | Daily on critical accounts, weekly across all 14. Drift opens an issue; nothing is silently reverted. |
Inspector, Macie and Shield Advanced ship off, one switch away, with the price written next to the switch. Encryption uses customer-managed KMS keys with annual rotation, and TLS 1.2 or above is enforced.
Shared responsibility
| Area | BuiltForProd | You |
|---|---|---|
| Design of the foundation | Owns it, and verifies it on deployment | Approves the decisions in your organization profile |
| Deployment | Executes it, against a checklist and objective verification checks | Provides the management account, mailbox, domain and named roles |
| Access to your environment | None after handover; under Managed, only what you grant | Grants, reviews and removes access in your identity provider |
| Production changes | Proposes them as reviewed pull requests | Holds final approval, always |
| Your data and application code | Never holds, processes or replicates it | Owns it, classifies it, retains it |
| The cloud itself | Not applicable | Your agreement with your cloud provider |
Reporting a vulnerability
If you believe you have found a security issue in anything BuiltForProd produces — this site, the delivered code, or the documentation platform — email [email protected] with "Security" in the subject line and enough detail to reproduce it.
We acknowledge reports, investigate them and keep you updated until they are resolved. We will not pursue anyone who reports in good faith, stays within their own test environment and does not access, modify or exfiltrate data belonging to anyone else.
If the issue concerns a live customer environment, say so in the subject line so it reaches an engineer faster.
Contact
- Security reports
- [email protected]
- Machine-readable policy
- /.well-known/security.txt
- Everything else
- Talk to us
Please do not include customer data, credentials or personal information in a report. A description of the issue is enough.
Questions about security and ownership
Do you keep access to our environment?
No. After handover BuiltForProd holds no principal, no role and no credential in your environment, and nothing in the delivered code names BuiltForProd. If you buy Managed afterward, our engineers work through groups you create in your own identity provider and can remove at any time.
Where do our credentials live?
Nowhere, in the sense that matters. The AWS Enterprise Baseline denies IAM users and access keys with a service control policy, so no long-lived AWS credential exists for anyone — not for your engineers, not for your pipeline and not for us. People sign in through single sign-on with multi-factor authentication; the pipeline federates through GitHub OIDC.
Who owns the accounts and the code?
You do, from the first day to the last. The cloud organization is created under your management account and billed to you, the repositories are created in your own version control organization, and the source is licensed to you under the PolyForm Internal Use License 1.0.0.
What is your responsibility and what is ours?
BuiltForProd is responsible for the design and the correctness of what it delivers and for verifying it on deployment. You are responsible for operating it afterward: your data, your application code, your users and access grants, and the production changes you approve. Your cloud provider is responsible for the cloud itself.
How do you handle production changes during a Managed engagement?
The same way your own engineers do. Every change is a pull request with a plan attached, reviewed under your CODEOWNERS and applied by your pipeline with production gated by your required reviewers. Nothing is applied from a laptop, and final approval on a production change is never delegated to us.
How do we report a security vulnerability?
Email [email protected] with "Security" in the subject line and enough detail to reproduce the issue. We acknowledge reports, investigate them and keep you updated until they are resolved, and we will not pursue anyone who reports in good faith and does not access or modify data belonging to others.
Is the product open source?
No. It is source-available: you receive the full source under the PolyForm Internal Use License 1.0.0, which lets your organization deploy, modify, fork and extend it internally but not resell or host it for third parties. It is built on open-source tooling, including OpenTofu, Terragrunt, Kubernetes and ArgoCD.
The controls above come from the Baseline, the properties they satisfy are in the Standard, and the evidence they produce is described on the compliance page.
Find out what production would take.
Tell us what you are running and what is coming: a funding round, an audit, a first enterprise customer, a migration. We will tell you what we would build, what it costs, and whether we are the right fit.