Is this change actually approved to ship to production?

One step in your pipeline. Nothing else to adopt.

Is this change actually approved to ship to production?

Approvegate is a deploy gate that checks every production release against a signed, artifact-bound approval — and fails the pipeline closed if the answer is no. Drop it into the CI job you already have.

Book a demoSee the check

Build

Test

Security scan

Approvegate

Deploy to production

.gitlab-ci.yml.github/workflows

deploy_service_to_prod: stage: deploy environment: name: production script: - approvegate check --service ledger-api # GitLab CI Component — coming soon

approvegate check → verdict

BLOCK

v2.14.3 has not been approved for prod deployment. Active approved deployment tickets - www.approvegate.io/team/approvegate/active

exit 1 · pipeline stopped

See it in action

The gate

Flip the controls. Watch the verdict change in real time.

Approval

A second approver has signed off.

Separation of duties

The approver isn't the requester.

Approval window

The approval hasn't expired yet.

Change freeze

Org-wide freeze window in effect.

Break glassReset

ALLOW

Approved, SoD satisfied, and the approval hasn't expired. Deploy allowed.

How it's built

One connected system. Two thin surfaces.

Approvegate isn't a portal you migrate into. It's an API your pipeline calls, backed by a minimal record of who approved what.

01 — the check

CI/CD package

A GitHub Action or GitLab CI step you drop into your existing deploy job. It calls the Approvegate API with the artifact version and service name — and the pipeline fails closed if the answer is no.

• ✓Zero UI for developers to visit — it's a pipeline step
• ✓Runs where you already deploy — GitHub Actions, GitLab CI
• ✓Fails with a reason, not a black box

→ calls the record below to decide

02 — the record

Minimal approval UI

Just enough surface to create a change request bound to an artifact, record who approved it, and attach the policy that governed it. Not a release planner. Not a second Jira.

• ✓Binds to a commit SHA or image digest automatically, at build time
• ✓Record approval — enforces SoD automatically
• ✓Auto-expires, so a stale approval can't authorize a later deploy

Audit evidence, on demand

Audit Evidence, Generated on Every Deploy

Every quarter, engineers lose 40+ hours screenshotting Jira tickets, PR approvals, and CI logs for SOC 2 audit samples. Approvegate binds tickets, PR reviews, commit SHAs, and approver identities into a tamper-evident audit package automatically, on every deploy — searchable by SHA, ticket, actor, service, or environment, and exportable as JSON or PDF in seconds. Hand us an auditor's CSV sample list and get back a signed zip, matched automatically.

.gitlab-ci.yml

deploy_service_to_prod: stage: deploy environment: name: production script: - approvegate check --service ledger-api

approvegate check → verdict: ALLOW

Separation of Duties

Passed · Author: @j\_doe, Approver: @m\_chen

Linked Ticket

CHG-4471 · Approved by CAB

Pre-requisite Scans

SAST & Security Scans Passed

Audit Log Sealed

SHA 9f2a1c…c17b

Freeze Window

None active · override logged if forced

Separation of Duties is hard-blocked at the pipeline — the commit author can never be the approver. Every field above is captured automatically; nothing to screenshot.

See it block a real deploy.

Email

Team size

Message

Request a demo

We respect your privacy. We respect your privacy.

TLDR: We use cookies for language selection, theme, and analytics. Learn more. TLDR: We use cookies for language selection, theme, and analytics. Learn more

Cookie settings Accept cookies