Skip to main content
The cloud policy is one policy for your tenant in SafeDep Cloud. A security admin changes it with the safedep CLI, and PMG and the pull request checks apply it. You change the policy of the whole fleet with no new MDM package.
The cloud policy needs the SafeDep Cloud Team or Enterprise plan. See pricing.

​
What the cloud policy controls

  • Package rules. Block a package for the whole tenant, or trust one package after a false positive. See Package Rules.
  • Dependency cooldown. Hold back package versions that are younger than a minimum age.
  • Pull request checks. Choose the lowest vulnerability severity that fails a check.
You can set a value for the whole tenant, or for a group of endpoints or projects with a policy override. See Policy Resolution.

​
What enforces each part

The settings reference gives the exceptions of each setting.

​
Who can change the policy

A user with the ReadOnly role or a higher role can read the policy, its revisions and its decisions. Only an Admin can create, edit, publish or delete a policy change, create or change a package rule, or set a label. Only an Admin can read the audit events.

​
How a change reaches the tools

  1. An Admin edits the policy with safedep policy edit. The edit makes a draft, a policy change.
  2. The Admin reads the preview with safedep policy change show.
  3. The Admin publishes the change. The publish makes a new policy revision.
  4. The next pull request check of each project uses the new revision. PMG on each endpoint applies it after its next policy fetch.
A package rule skips the draft: safedep policy rule create publishes at once. See Policy Revisions and Changes.

​
Set up the tools

Apply the cloud policy in PMG

Turn on cloud.policy in PMG on developer machines and CI runners.

Pull request checks

Use the policy in the GitHub App and the Bitbucket app.

​
Guides

Quickstart

Publish your first policy with the safedep CLI.

Block a Package

Block a package for the whole tenant during an incident.

Trust a Package

Trust a package after a false positive.

Set a Cooldown

Set the dependency cooldown for the tenant or for a group.

Target a Group

Label endpoints and projects and write a policy override.

Fail Pull Request Checks

Choose the severities that fail a check for a group of projects.

Roll Back a Change

Restore a setting from an old revision.

Explain a Decision

Find the rule or setting that blocked a package or failed a check.

Audit Policy Changes

See who changed the policy, and when.

​
Reference

Cloud Policy Settings

Each setting, its type and its default.

Cloud Policy Limits

Limits, retention and known gaps.