Coreload runs GitHub Actions jobs on bare-metal servers in France and Canada. Each job runs in a fresh, single-use VM that never serves a second job or a second customer, and its disk and memory are deleted when the job ends. Coreload does not store your secrets.
The Coreload CI GitHub App asks only for organization self-hosted runners (write), and Actions and metadata (read) on the repositories you choose. It has no access to your repository contents, issues, pull requests or secret values.
Compliance: our SOC 2 Type I work is in progress. No SOC 2 report has been issued yet.
Read the full security model at https://coreload.com/docs/security/. Security questions: hello@coreload.com.