initial
This commit is contained in:
olegs committed
commit
6c65691b2e
45 files changed
+8837
No files matched your search
@@ -0,0 +1,192 @@
|
||||
# Aikido Security - Enterprise Compatibility Evaluation
|
||||
|
||||
## Tool Overview
|
||||
**Name:** Aikido Security
|
||||
**Website:** https://aikido.dev
|
||||
**Category:** AI-Powered Security Platform (Pentesting, Code/Cloud Security)
|
||||
**Date Evaluated:** 2026-02-02
|
||||
|
||||
---
|
||||
|
||||
## Privacy & Enterprise Use
|
||||
|
||||
### Commercial/Enterprise Use Permission
|
||||
**Status:** ✅ APPROVED FOR ENTERPRISE USE
|
||||
|
||||
**Key Findings:**
|
||||
- Positions as "developer-first" security tool
|
||||
- Well-funded startup (recent funding rounds)
|
||||
- Enterprise-focused features available
|
||||
- Designed for commercial use with SaaS and on-prem options
|
||||
|
||||
### Model Training on User Data
|
||||
**Status:** ✅ LIKELY SAFE (NO PUBLIC INDICATION OF TRAINING)
|
||||
|
||||
**Key Findings:**
|
||||
- **No public statements indicating customer code used for training**
|
||||
- GDPR compliant by design (EU regulations require disclosure)
|
||||
- Trust Center emphasizes privacy
|
||||
- Based on industry standards: AI likely trained on public vulnerability data, NOT private customer code
|
||||
|
||||
**Data Processing:**
|
||||
- Scans source code and cloud configurations
|
||||
- Uses AI-driven pentesting and simulation
|
||||
- Static analysis and AI agent testing
|
||||
- Results stored securely per customer account
|
||||
|
||||
**GDPR Compliance:**
|
||||
- Any use of customer data for training MUST be disclosed under GDPR
|
||||
- Absence of such disclosure suggests no training usage
|
||||
- Privacy Officer listed for concerns
|
||||
- Data protection by design philosophy
|
||||
|
||||
### Data Retention Policies
|
||||
**Status:** ⚠️ NOT PUBLICLY SPECIFIED
|
||||
|
||||
**Key Findings:**
|
||||
- Retention period not publicly disclosed
|
||||
- Enterprise customers can likely negotiate terms
|
||||
- Scan results and findings stored for dashboard access
|
||||
- Likely follows industry standard retention (6-12 months)
|
||||
|
||||
### Data Sharing Practices
|
||||
**Status:** ✅ NO EXTERNAL SHARING (ASSUMED)
|
||||
|
||||
**Third-Party Sharing:**
|
||||
- Customer data segregated per account
|
||||
- No indication of external sharing
|
||||
- GDPR compliance requires strict data handling
|
||||
- Privacy Policy states they don't sell data
|
||||
- Data shared only with third parties needed to deliver services
|
||||
|
||||
**Infrastructure:**
|
||||
- Multi-region hosting available
|
||||
- On-premise options for sensitive organizations
|
||||
- Private cloud deployments possible
|
||||
|
||||
### IP & Confidentiality Concerns
|
||||
**Status:** ✅ STRONG PROTECTIONS (ASSUMED)
|
||||
|
||||
**Intellectual Property:**
|
||||
- You own your code and vulnerability findings
|
||||
- Aikido provides scanning and pentest results
|
||||
- No IP claims on customer code
|
||||
- Reports and findings belong to customer
|
||||
|
||||
**Confidentiality:**
|
||||
- GDPR-centric privacy approach
|
||||
- SOC 2 compliance likely in progress (newer company)
|
||||
- Designed for enterprise pentesting (inherently sensitive)
|
||||
|
||||
---
|
||||
|
||||
## Pricing & Plans
|
||||
|
||||
### Pricing Model
|
||||
**Structure:** Tiered subscription (public pricing not fully disclosed)
|
||||
|
||||
**Known Tiers:**
|
||||
- **Free:** For students and open-source projects
|
||||
- **Paid Plans:** Per-app or platform subscription
|
||||
- **Enterprise:** Custom pricing with advanced features
|
||||
|
||||
### Features
|
||||
**Free Tier:**
|
||||
- Students get Aikido free
|
||||
- Open-source project support
|
||||
|
||||
**Enterprise Features:**
|
||||
- AI-powered pentesting agents
|
||||
- Code and cloud security scanning
|
||||
- Continuous monitoring
|
||||
- Integration with CI/CD
|
||||
- SSO and role-based access
|
||||
|
||||
### Usage Limits
|
||||
- Free tier: Limited scans/apps
|
||||
- Paid tiers: Based on number of apps or scan frequency
|
||||
- Enterprise: Likely unlimited or high limits
|
||||
|
||||
---
|
||||
|
||||
## Enterprise Compatibility Assessment
|
||||
|
||||
### Strengths ✅
|
||||
- **GDPR compliant by design** (privacy-first approach)
|
||||
- **No indication of training on customer code**
|
||||
- AI pentesting with developer-friendly UX
|
||||
- Privacy Officer available for concerns
|
||||
- On-premise deployment options
|
||||
- Multi-region hosting
|
||||
- Modern, well-funded platform
|
||||
|
||||
### Concerns ⚠️
|
||||
- **Newer company** - less track record than established players
|
||||
- **Limited public documentation** on data handling specifics
|
||||
- SOC 2 compliance status unclear (likely in progress)
|
||||
- Retention policies not transparent
|
||||
- **Requires verification** of privacy claims
|
||||
|
||||
### Recommendations
|
||||
|
||||
**✅ PROVISIONALLY APPROVED WITH VERIFICATION**
|
||||
|
||||
**Action Required BEFORE Use:**
|
||||
1. **Request written confirmation:** No customer code used for training
|
||||
2. **Verify SOC 2 status:** Check current compliance certifications
|
||||
3. **Clarify data retention:** Get specific retention policies in writing
|
||||
4. **Review DPA:** Ensure Data Processing Agreement covers all concerns
|
||||
5. **Consider on-prem:** For highly sensitive codebases
|
||||
|
||||
**Best For:**
|
||||
- Organizations wanting modern AI-powered security testing
|
||||
- Teams using continuous pentesting
|
||||
- Companies comfortable with newer vendors (after verification)
|
||||
- Cloud-native applications
|
||||
|
||||
**Not Ideal For (without verification):**
|
||||
- Highly regulated industries requiring established vendors
|
||||
- Organizations with strict "proven track record" requirements
|
||||
- Companies unable to get written privacy guarantees
|
||||
|
||||
**For Hack Days:**
|
||||
- ⚠️ **Use with caution** - requires connecting to code repository
|
||||
- Should get written confirmation of privacy policies first
|
||||
- Consider using on non-sensitive code first
|
||||
- Alternative: Use established tools (Snyk) if time-constrained
|
||||
|
||||
### Comparison to Alternatives
|
||||
- **Snyk:** More established, explicit "no training" policy, broader adoption
|
||||
- **Escape AI:** Similar AI pentesting, also newer company
|
||||
- **Traditional SAST/DAST:** More established but less AI-native
|
||||
|
||||
---
|
||||
|
||||
## Sources & References
|
||||
|
||||
1. **ChatGPT Evaluation Report** - Aikido Security analysis
|
||||
2. **Aikido Website**: https://aikido.dev
|
||||
3. **Trust Center**: Mentioned GDPR compliance
|
||||
4. **Privacy Policy**: States no data selling, GDPR focused
|
||||
|
||||
---
|
||||
|
||||
## Notes
|
||||
- Last Updated: 2026-02-02
|
||||
- Evaluator: Claude Code based on ChatGPT findings
|
||||
- **Key Finding:** Aikido appears safe based on GDPR compliance and lack of training disclosures, but requires verification due to limited public documentation
|
||||
- **Status:** Newer player with strong privacy stance, but needs written confirmation before enterprise use
|
||||
|
||||
---
|
||||
|
||||
## ⚠️ VERIFICATION CHECKLIST
|
||||
|
||||
Before using Aikido Security, obtain written confirmation of:
|
||||
- [ ] No customer code used for AI model training
|
||||
- [ ] Specific data retention periods
|
||||
- [ ] SOC 2 Type II certification status
|
||||
- [ ] Data Processing Agreement (DPA) terms
|
||||
- [ ] On-premise deployment options (if needed)
|
||||
- [ ] Incident response and breach notification procedures
|
||||
|
||||
**Recommendation:** For hack days, use established tools (Snyk) unless Aikido verification can be completed quickly. For production use, complete full verification process.
|
||||
Reference in new issue
Block a user