We code sign Windows executables, installers, and libraries: .exe, .msi, and .dll files, both 32-bit and 64-bit, plus MSIX and APPX packages. Apps built with any Windows-compatible compiler are supported, including PyInstaller, Electron, Tauri, .NET (C#, Visual Basic .NET, VB6), C++, Rust, Go, Delphi, Java (jpackage), Inno Setup, and NSIS.

Apps signed through Bamboo Deploy carry a valid Authenticode SHA-256 signature from our Sectigo Extended Validation (EV) certificate, so Windows shows a verified publisher instead of "Unknown publisher", and most Windows Defender false-positive flags clear for your signed binaries. Microsoft no longer gives any certificate type instant SmartScreen reputation (EV lost that in 2024), so reputation now comes from a certificate's signing history. Ours has signed hundreds of clean builds, which a new certificate of your own would have to earn from zero. A brand new file can still see an occasional prompt until it has some downloads.

No, you don't need any signing hardware on your end. You upload your binary, our service signs it, and you download the signed file. No USB tokens to plug in, no signing software to install on your machine, no expensive hardware to rent.

Traditional certificate authorities like DigiCert, Sectigo, and SSL.com sell yearly code signing certificates. Standard OV certificates typically cost several hundred dollars per year, while EV certificates can run a thousand dollars or more annually, plus they require business identity verification and ship a physical USB token to your address. Bamboo Deploy is a $45 per quarter subscription (that works out to $15 per month) with EV-grade code signing included, no certificate purchase, no identity validation paperwork, no shipped token, no minimum contract, and a 30-day money-back guarantee. Cancel anytime.

Yes. Bamboo Deploy exposes a REST API at api.bamboodeploy.com. Generate an API key from the dashboard and call it from GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines, or any tool that can make HTTP requests. A few API calls return a fully signed Authenticode binary as a CI artifact, ready to ship with your release.

In most cases, yes. Bundlers and installers like PyInstaller, Electron, Tauri, NSIS, Inno Setup, AutoIt, and py2exe package an interpreter or runtime alongside your code, and antivirus engines often flag the unsigned executable as suspicious because of the packing pattern, not because of malicious code. A valid Authenticode signature signals to Windows Defender, SmartScreen, and third-party antivirus that the binary comes from a verified, EV-validated publisher, which clears most false positives. Avoiding generic compression packers before signing further reduces flags.

Yes. Most portable apps can be bundled into a Windows installer (.msi or signed .exe setup file) for a cleaner user install experience. You can add multiple files, configure installer settings such as icon, app name, default install directory, wizard image, and more. The resulting installer is then code signed like any other binary.

Every uploaded binary runs through a multi-stage security analysis before signing. We check the file structure, scan for known malware indicators, look for risky behavioral signals, and detect signs of obfuscation or packing. We also surface the Authenticode status of any pre-existing signature. The full scan report is visible in your dashboard for each upload.

A flagged scan does not auto-reject your app. The scan report appears in your dashboard with the specific indicators that triggered the flag, so you can see exactly what the scanner saw. False positives are common for bundled apps built with PyInstaller, Electron, Tauri, Inno Setup, or NSIS, since the packing pattern looks unusual to generic security tools. If you believe your app was flagged in error, contact support and we will review it. Apps that match high-confidence malicious indicators will not be signed.

Most apps are signed within minutes of upload. The security scan runs first, typically completing in under a minute, then the file is signed and made available for download or via the REST API.

All apps you signed during your active subscription stay signed and continue to work for your users. If you cancel, you simply lose the ability to sign new apps or new versions until you resubscribe. Apps already in your users' hands keep running normally.

Bamboo Deploy comes with a 30-day money-back guarantee. Sign up, sign as many apps as you want during the first 30 days, and if it is not the right fit, contact support for a full refund.