Zero Source Retention
Your source code is automatically deleted after every build. No proprietary code remains on the build server — ever.
Secrets Never Touch Disk
Signing certificates, keychains, and environment secrets are cleaned after every build. Secrets exist only in memory during the build.
Sanitized Build Logs
All secret values are automatically scrubbed from build logs before they reach the Dashboard. No accidental leaks.
Private Artifact URLs
Install links use Mach public file routes such as files.getmach.dev, so users do not see raw S3 bucket or presigned URLs.
Only Public Packages Cached
The only data retained between builds is open-source packages from public registries (npm, CocoaPods). Nothing proprietary.
Mach is built for teams that take security seriously. After every build completes, you'll see this confirmation in your build logs:
🔒 Security: No source code retained on build server. Only public dependencies cached.
This isn't just a message — it's enforced by the build system architecture. Source files, build outputs, and all signing materials are physically removed after every build.