---
title: "9apes Security - Isolated GitHub Actions Runners"
description: "How 9apes secures GitHub Actions jobs with isolated microVMs, scoped JIT tokens, GitHub SSO, encrypted cache storage, and audited access."
url: https://9apes.com/security/
---

# 9apes Security - Isolated GitHub Actions Runners

Your jobs run in isolated microVMs on dedicated bare metal. Every token is scoped. Every microVM is destroyed when the job ends.

## Compliance

- SOC 2 in progress

- ISO/IEC 27001:2022 data centers

- Quarterly pen testing

- GitHub SSO only

## How jobs are isolated

- **Job isolation** — Every job runs in a secure, isolated Firecracker microVM on bare metal, protected by a private VPN. When the job completes, the microVM is destroyed along with all its state. Jobs never share kernels.

- **JIT tokens** — For each job, we generate a just-in-time (JIT) token — scoped to that job, expires after one hour. Our GitHub integration has no ability to directly access organization or repository-level secrets.

- **Cache security** — Artifacts cached on Cloudflare R2, co-located on the same bare-metal fleet. Access is authenticated and audited. Data is encrypted and isolated by organization.

- **Login & access** — Login is exclusively through GitHub SSO. Once integrated, GitHub forwards job requests to us — we never initiate access to your repositories.

- **Compliance** — SOC 2 in progress. Hardware runs on ISO/IEC 27001:2022 certified data centers. We answer security questionnaires. We pay hackers to pen test our system every quarter.

## GitHub App permissions

| Permission | Why 9apes asks for it |

| --- | --- |

| Read access to members and metadata | To list users in our settings page |

| Read and write access to actions, code, pull requests, and workflows | For our migration wizard to make a pull request with all the required code changes |

| Read and write access to organization self-hosted runners | To generate just-in-time (JIT) tokens and enable our managed runners to run your jobs |