initial

evaluation_security_aikido.md

@@ -0,0 +1,281 @@
+# Security AI Tool Evaluation: Aikido
+
+## Tool Overview
+**Name:** Aikido Security
+**Type:** All-in-One Security Platform
+**Website:** https://www.aikido.dev
+**Primary Function:** Application security, vulnerability scanning, SAST, DAST, SCA, secrets detection, compliance monitoring
+
+---
+
+## Privacy Policy & Enterprise Compatibility
+
+### Commercial/Enterprise Use Permission
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Privacy Policy: https://www.aikido.dev/privacy
+- Terms of Service: https://www.aikido.dev/terms
+- Legal Documentation: https://www.aikido.dev/legal
+
+**Key Questions:**
+- Does the privacy policy explicitly permit commercial use?
+- Are there any restrictions on enterprise deployment?
+- What is the licensing model for commercial use?
+- Any industry-specific restrictions?
+
+### Data Training & Model Use
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Privacy Policy: https://www.aikido.dev/privacy
+- AI/ML disclosure in documentation
+- Security documentation: https://docs.aikido.dev/
+
+**Key Questions:**
+- Is customer code used to train or improve AI models?
+- Does Aikido use AI/ML for vulnerability detection?
+- Can customers opt out of data collection for model training?
+- How is code analyzed (locally vs cloud)?
+- What data is collected during scans?
+- Is any data anonymized and aggregated?
+
+### Data Retention Policies
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Privacy Policy: https://www.aikido.dev/privacy
+- Data Processing Agreement (DPA)
+- GDPR compliance documentation
+
+**Key Questions:**
+- How long is scan data retained?
+- How long are vulnerability reports stored?
+- What is the data deletion policy?
+- Can customers request data deletion?
+- Data retention for different data types (logs, scans, reports)
+- Backup retention periods
+
+### Data Sharing Policies
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Privacy Policy: https://www.aikido.dev/privacy
+- Subprocessor List
+- Third-party integrations documentation
+
+**Key Questions:**
+- Is data shared with third parties?
+- Who are the subprocessors?
+- Is data shared across Aikido customers?
+- Are vulnerability patterns aggregated/anonymized?
+- What data is shared with integrations (Slack, Jira, etc.)?
+
+### IP & Confidentiality Concerns
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Terms of Service: https://www.aikido.dev/terms
+- Enterprise Agreement
+- Intellectual Property Policy
+- Confidentiality provisions
+
+**Key Questions:**
+- Who owns the IP rights to scan results?
+- Are there confidentiality protections for proprietary code?
+- What happens to customer code during scanning?
+- Is source code stored or only analyzed?
+- Are there NDA provisions for enterprise customers?
+- How are secrets/credentials handled during detection?
+
+---
+
+## Pricing & Plans
+
+### Free Tier
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Pricing Page: https://www.aikido.dev/pricing
+- Documentation: https://docs.aikido.dev/
+
+**Information Needed:**
+- **Features Included:** Which security modules (SAST, DAST, SCA, secrets, etc.)
+- **Repository Limits:** Number of repositories that can be scanned
+- **User Limits:** Number of team members
+- **Scan Limits:** Number of scans per month
+- **Duration:** Is it free forever or a trial period?
+- **Support Level:** Community, email, or chat support?
+- **Integration Limits:** Which integrations are available?
+
+### Paid Plans
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Pricing Page: https://www.aikido.dev/pricing
+- Contact sales for detailed pricing
+
+**Plans to Document:**
+
+#### Starter/Pro Plan (if available)
+- **Cost:** $ per user/month or $ per repository/month
+- **Features:** List key features
+- **Limits:** Repositories, users, scans
+- **Support:** Level of support included
+- **Integrations:** Available integrations
+
+#### Business/Team Plan (if available)
+- **Cost:** $ per user/month
+- **Features:** Advanced features
+- **Limits:** Higher or unlimited limits
+- **Support:** Priority support
+- **Additional:** Advanced integrations, compliance features
+
+#### Enterprise Plan
+- **Cost:** Custom pricing (contact sales)
+- **Features:** Full feature set, SSO, SAML, advanced reporting
+- **Limits:** Typically unlimited or very high
+- **Support:** Dedicated support, SLAs, CSM
+- **Additional:** Custom DPA, compliance certifications, on-premise options
+
+---
+
+## Usage Limits
+
+### API Rate Limits
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- API Documentation: https://docs.aikido.dev/api
+- Rate Limiting Documentation
+
+**Information Needed:**
+- API requests per hour/day
+- Webhook limits
+- Different limits per plan tier
+- Rate limit headers and policies
+
+### Repository/Project Limits
+**Status:** REQUIRES MANUAL VERIFICATION
+**Information Needed:**
+- Number of repositories per organization
+- Number of active scans
+- Repository size limits
+- Limits vary by plan tier
+
+### User/Seat Limits
+**Status:** REQUIRES MANUAL VERIFICATION
+**Information Needed:**
+- Minimum seats for paid plans
+- Maximum collaborators
+- Read-only user limits
+- Guest/external user policies
+
+### Scan Limits
+**Status:** REQUIRES MANUAL VERIFICATION
+**Information Needed:**
+- Number of scans per month
+- Concurrent scan limits
+- Scan frequency (continuous vs scheduled)
+- Size limits for scanned assets
+- Timeout limits for scans
+
+### Integration Limits
+**Status:** REQUIRES MANUAL VERIFICATION
+**Information Needed:**
+- Number of integrations per plan
+- API connection limits
+- Webhook delivery limits
+
+---
+
+## Enterprise-Specific Considerations
+
+### Compliance & Certifications
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Security/Trust page: https://www.aikido.dev/security (or similar)
+- Compliance documentation
+
+**Check for:**
+- SOC 2 Type II certification
+- ISO 27001
+- GDPR compliance
+- CCPA compliance
+- Industry-specific compliance (HIPAA, PCI-DSS, etc.)
+- OWASP Top 10 coverage
+- CWE/CVE database integration
+
+### Deployment Options
+**Status:** REQUIRES MANUAL VERIFICATION
+**Check for:**
+- Cloud-hosted (SaaS)
+- Self-hosted/on-premise options
+- Private cloud deployment
+- Air-gapped environment support
+- Multi-tenant vs single-tenant
+- Data residency options (EU, US, etc.)
+
+### Security Features
+**Status:** REQUIRES MANUAL VERIFICATION
+**Check for:**
+- SSO/SAML support
+- SCIM provisioning
+- Role-based access control (RBAC)
+- Audit logging
+- Data encryption (in transit and at rest)
+- Two-factor authentication (2FA)
+- IP whitelisting
+- Secrets management integration
+
+### Integration Ecosystem
+**Status:** REQUIRES MANUAL VERIFICATION
+**Check for:**
+- Git providers (GitHub, GitLab, Bitbucket)
+- CI/CD platforms (Jenkins, CircleCI, GitHub Actions)
+- Issue trackers (Jira, Linear, GitHub Issues)
+- Communication (Slack, Microsoft Teams)
+- Cloud providers (AWS, Azure, GCP)
+- Container registries
+
+---
+
+## Research Checklist
+
+- [ ] Read complete privacy policy
+- [ ] Review terms of service
+- [ ] Check pricing page for current costs and plans
+- [ ] Review API documentation for rate limits
+- [ ] Check for Data Processing Agreement (DPA)
+- [ ] Verify GDPR/compliance information
+- [ ] Review documentation for deployment options
+- [ ] Check security/trust center for certifications
+- [ ] Test free tier if possible (sign-up requirements)
+- [ ] Contact sales for enterprise-specific information
+- [ ] Review integration documentation
+- [ ] Check for customer case studies or testimonials
+
+---
+
+## Additional Resources
+
+- Documentation: https://docs.aikido.dev/
+- Blog: https://www.aikido.dev/blog
+- GitHub: Check for open-source components or examples
+- Status Page: Check for uptime/status page
+- Support: Check for support portal or contact information
+
+---
+
+## Notes
+
+**Important Considerations for Aikido:**
+1. Aikido is a relatively newer platform - verify company stability and funding
+2. Check if "all-in-one" approach means different data handling per module
+3. Verify if cloud scanning means code leaves customer infrastructure
+4. Understand how secrets detection works and if secrets are stored
+5. Check if DAST scanning requires exposing applications
+6. Verify if continuous monitoring means persistent data collection
+7. Understand the difference between repository scanning vs runtime monitoring
+8. Check if vulnerability database is proprietary or uses public CVE feeds
+
+**Competitive Positioning:**
+- Compare to Snyk, Semgrep, Checkmarx
+- Note unique features or limitations
+- Evaluate maturity of the platform
+
+**Last Updated:** [DATE TO BE ADDED AFTER RESEARCH]
+**Researcher:** [TO BE COMPLETED]
+**Verification Status:** Template - Requires Manual Research