SaaS Doesn’t Mean Secure: Why You Should Back Up Your Source Code

Your source code sits on GitHub, GitLab, Bitbucket, or Azure DevOps, along with your pipeline configurations, issue history, permissions, and metadata. Most teams assume it’s safe there because it works. But is it?

Financial institutions, technology companies, and software houses all build the systems they run on. Code stopped being a byproduct of the business and became the business. And as it turns out, it needs protection of its own.

Xopero had spent years protecting other companies’ data. But one question was nagging its founder, Łukasz Jesis: What happens if we lose our intellectual property, the source code and the metadata? “Don’t worry, we have it protected somehow,” his team answered. But nobody knew exactly how. And GitProtect was created to fill that gap.

GitProtect is the DevOps line of Xopero, a seasoned backup and disaster recovery vendor with over 15 years of experience.

You buy a service, not protection

Your provider keeps the platform running, ensuring its uptime, availability, and infrastructure. What lives on that platform belongs to you, and so does the ability to get it back when disaster strikes. This is the logic behind the shared responsibility model that Git platforms operate on.

SaaS means comfortable and easy to use. But that isn’t the same as secure. Łukasz elaborates on that case on Scaling Cyber, hosted by Ignacio Sbampato, who spent over a decade as Chief Business Officer at ESET. His podcast profiles cybersecurity founders building outside the usual US and Israel hubs.

Beyond the shared responsibility argument, Xopero and GitProtect’s founder shares insider details about the DevOps tools market and industry, including their first major deal: a Fortune 500 company that signed in roughly a week, because it already had a serious problem to solve. 

Such a damage-control approach is still quite common among companies. However, Łukasz Jesis suggests a more cautionary one. Listen to the full conversation to learn why:

How DevOps security is evolving

The pressure to close the DevOps security gap no longer comes only from inside organizations. It comes from auditors as well.

What used to be a simple checkbox has evolved into an in-depth analysis of your backup and recovery strategy. Auditors now want to know which systems are covered, how often copies are made, where they are stored, when the last restore was tested, and who signed off on it. “We’re on GitHub” answers none of that.

This makes proof as important as protection. Retention policies you can point to, restore logs you can produce, a current map of what’s covered and what isn’t. That’s the difference between having a backup and demonstrating true cyber resilience, which is often required by contractors and industry standards such as ISO 27000 and SOC 2. 

And that’s exactly the gap that GitProtect closes.

Which leads us to the final question: If your repositories disappeared tomorrow, would the answer be “we have it protected somehow”?