Yes. Terragrunt Scale was designed with a strong security posture from day one, which makes it a fit for enterprise and regulated environments. There is no SaaS control plane: all operations run inside your own runners and repositories using standard GitHub Actions or GitLab CI pipelines, and it can run fully self-hosted on self-hosted GitLab or GitHub Enterprise Server. Your state lives in your own cloud (for example, an S3 bucket), and authentication uses OIDC to obtain temporary, short-lived credentials at runtime, so no cloud credentials are stored in the pipeline. Access follows the principle of least privilege, changes go through pull/merge-request review with branch-protection-enforced approvals, and you get a complete audit trail of who changed what, when, and why. Terragrunt Scale does not hold compliance certifications of its own: your code and data live in your SCM, so the security model is inherited from GitHub or GitLab.
Terragrunt Pipelines
is an out-of-the-box, best practices, secure CI/CD pipeline, built for Terragrunt, by the creators of Terragrunt.
Terragrunt Drift Detection
regularly compares your live cloud resources to your IaC and automatically opens pull requests to eliminate infrastructure drift.
Terragrunt Patcher
is a dependency management tool that keeps your OpenTofu/Terraform modules up to date, even through breaking changes.
