Security at Serverless

We are committed to maintaining the highest standards of security and compliance. Our comprehensive security program protects your data and gives you confidence when using our products and services.

Compliance & Certifications

Serverless, Inc. undergoes regular third-party audits to validate our security controls and ensure we meet industry standards.

SOC 2 Type I

Available

Our SOC 2 Type I report is available, demonstrating that our security controls are properly designed and implemented to meet the security trust service criteria and protect against unauthorized access at a specific point in time.

SOC 2 Type II

Available

Our SOC 2 Type II report is available, demonstrating that our security controls have been operating effectively over time. This audit validates the ongoing effectiveness of our security program against unauthorized access and security threats.

Our Security Program

Serverless, Inc. maintains a comprehensive security program built on industry best practices and continuous improvement.

Data Encryption

All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption.

Access Controls

Role-based access control with least-privilege principles and regular access reviews.

Monitoring & Logging

Comprehensive logging and real-time monitoring of all system activities and security events.

Incident Response

Documented incident response procedures with defined escalation paths and communication protocols.

Infrastructure Security

Hosted on AWS with defense-in-depth architecture, network segmentation, and regular patching.

Vendor Management

Rigorous vendor security assessments and ongoing monitoring of third-party service providers.

Security Policies & Practices

Our security policies are reviewed annually and align with SOC 2 trust service criteria.

Secure Development Lifecycle

  • Code reviews for all changes
  • Automated security scanning in CI/CD
  • Dependency vulnerability monitoring
  • Responsible vulnerability disclosure program

Employee Security

  • Background checks for all employees
  • Security awareness training
  • Confidentiality agreements
  • Secure endpoint management

Business Continuity

  • Disaster recovery planning
  • Regular backup testing
  • Multi-region redundancy
  • Defined RTO and RPO objectives

Privacy & Data Protection

  • Data minimization principles
  • Clear data retention policies
  • Customer data isolation
  • Data protection best practices

Using the CLI Without the Dashboard

For organizations with strict security requirements, the Serverless Framework CLI can operate as a fully on-premise tool with minimal external connectivity.

Source Available for Security Review

The Serverless Framework CLI is source available, allowing your security team to review the complete codebase. Inspect exactly what runs in your environment and verify our security practices firsthand.

The Serverless Framework CLI is locally installed software that, by default, does not interact with Serverless, Inc. servers except for limited network requests for license compliance. The optional Serverless Framework Dashboard provides additional features like Observability and Secrets Management, but it is not required.

Many enterprises rely exclusively on the Serverless Framework CLI for mission-critical workloads. As a locally executed tool, the CLI offers full control and customization, aligning well with strict corporate security and compliance requirements.

License Keys

If your organization wants to use only the CLI and not the Dashboard, License Keys are the solution. Using License Keys disables Dashboard access by default, ensuring the CLI operates solely as an on-premise product.

Simple Identifiers

License Keys validate and track subscription usage only; no access control or permissions.

Disables Dashboard

Eliminates all Dashboard requests except License Key validation and telemetry.

No Expiration

Keys don't expire, avoiding service disruption while still allowing rotation as a best practice.

Flexible Distribution

Create and distribute as many keys as needed, by company, team, app, or developer.

Network Requests

When not used with the Dashboard, the CLI makes the following network requests to Serverless, Inc. backend services:

Check Version

Checks for the latest version of the CLI.

https://install.serverless.com/versions.json

Update Version

Downloads updates when required.

https://install.serverless.com/archives/*

Validate License

Validates the License Key during initialization.

https://core.serverless.com/api/bff

Send Telemetry

Sends minimal usage data for license compliance.

https://core.serverless.com/api/events/*

License Telemetry

The CLI collects minimal telemetry to measure usage for subscription billing. This data uniquely identifies each Service Instance (a deployed serverless.yml in a specific Stage and Region):

Data Property Description
License Key Used to attribute usage to the correct organization & subscription.
Service Name The "service" value in the serverless.yml configuration file.
Region Name The AWS region where the application is being deployed.
Stage Name The environment (e.g., "production", "development", "testing").
AWS Account ID The unique identifier of the AWS account for deployment.
AWS CloudFormation Stack ID The unique identifier of the CloudFormation Stack managed by the CLI.

Reporting Security Vulnerabilities

We appreciate the security research community and encourage responsible disclosure of any vulnerabilities you discover.

Serverless Framework

For security vulnerabilities in the source-available Serverless Framework CLI, please report them through GitHub Security Advisories for coordinated disclosure.

Serverless Dashboard

For security issues related to the Serverless Framework Dashboard, APIs, or any Serverless, Inc. hosted services, please contact our security team directly.

Have Security Questions?

Our security team is available to assist with inquiries, security questionnaires, or compliance documentation requests.