The half of privacy that is engineering.
A policy about what we do not collect is worth nothing if the little we do collect sits behind a password some support agent can reset over chat. This page covers the other half: how the account, the hypervisor and the people are constrained.
Your account
Passwords
scrypt with a per-account salt at N=2^16, r=8, p=1, which costs about a tenth of a second on our own hardware. No maximum length, no composition rules, no forced rotation. All three of those make passwords worse and always have.
Breach checking
New passwords are checked against a local corpus of known-compromised hashes. The check runs entirely on our side, since sending part of your password hash to somebody else would be a strange thing to do on this particular website.
Two-factor, properly
Time-based codes and hardware security keys, with WebAuthn as the preferred path. There is no option to receive a code by text, for the obvious reason that we have no phone number for you and would rather not start collecting one.
Recovery codes
Ten single-use codes, displayed once, hashed at rest. They are the entire recovery story, because no other means of identifying you exists and we will not invent one under pressure.
Sign-in alerts
A device we have not seen before triggers a mail. It is one of the few jobs the seven-day access log actually does.
Lose the mailbox and the recovery codes and the account is gone. Not recoverable by ticket, not recoverable by proving a payment, not recoverable at all. That is the price of a one-field sign-up, and it is not negotiable in either direction.
Sessions
Lifetime
Fourteen days for a remembered session, four hours where you did not tick the box. Both limits are absolute, with no sliding renewal keeping a stolen cookie alive indefinitely.
Binding
Each session is tied to the user agent and to a coarse network prefix. Change continent mid-session and you sign in again, which irritates about one customer a month and is worth the irritation.
The device list
Every live session appears in the panel with its last-seen time. Kill them individually, or kill all of them and start again.
Sensitive actions re-prompt
Changing the email address, disabling two-factor, minting an API token or nominating a refund address all ask for the password again regardless of how fresh the session is.
Cookies
One session cookie, first-party, strict same-site. Nothing else is set, and you are asked nothing about it, because there is no consent to collect for cookies that do not exist.
API tokens
The API does everything the panel does, so a leaked token is as serious as a leaked password. Token handling starts from that assumption rather than arriving at it later.
Scoped
Read, write and destroy are separate permissions. Most automation needs the first two and almost none needs the third, and a token that cannot delete an instance cannot delete your instances.
Hashed at rest
Shown once at creation and never again. We keep a hash, so a database dump yields no working credentials.
Prefixed
Every token carries a fixed prefix, which makes it trivially findable by a repository scan you run yourself before pushing something you will regret.
Pinnable
A token can be restricted to a source network and to a named set of instances. Both restrictions are evaluated on every call rather than once at issue.
Expiring
Optional expiry from an hour upward and a mandatory ceiling of two years. Tokens that never expire are how old automation quietly becomes an old vulnerability.
Rate limited per token
Limits apply to the token rather than the account, so a runaway script throttles itself instead of your other automation.
Isolation between tenants
Every instance is a guest on a host that does exactly one job. What follows is what stands between your guest and everybody else’s.
No memory sharing
Same-page merging is off across the fleet, permanently. Deduplicating memory between tenants is a measurable side channel, and the RAM it recovers is not worth the class of attack it opens.
No overcommit
Cores, memory and NVMe are allocated once and never counted twice. No ballooning, no swap on the host, and no scheduler trick standing in for capacity we declined to buy.
Separate storage domains
Each guest sits on its own volume in its own encrypted namespace. Reclaiming a volume means discarding the key and trimming the range, rather than writing zeroes over it and hoping.
Network separation
One bridge per tenant, address and hardware-address filtering at the port, and broadcast domains that stop at the guest. A neighbour’s traffic never reaches your port, so there is nothing there for you to capture.
GPU passthrough
A card is bound to a single guest through the IOMMU and reset between tenancies. No time-slicing, no vGPU layer, and no shared driver sitting in the middle of two customers.
Mitigations stay on
Speculative-execution mitigations are enabled and stay enabled. Hosts are patched monthly, and out of band when something warrants it, which over the past two years has happened three times.
Encryption, and what it protects
Every node volume is encrypted at rest. Keys live in the host’s secure element and are released only to a kernel that has booted a measured, signed image, so a drive pulled from a chassis is a brick and a chassis carried out of a building is a slower brick.
The limit deserves stating clearly. Encryption at rest defends against removal, theft and the end of a drive’s working life. It cannot defend against a running hypervisor, which necessarily holds the key while your instance is running. Anyone whose threat model includes the host should run full-disk encryption inside the guest and type the passphrase over the out-of-band console at boot, which is a supported path with a proper page in the knowledge base.
Snapshots and off-node backups are encrypted inside the instance before they leave it, to a key you hold and we never see. We store ciphertext and a length. Restores are decrypted by you, which is inconvenient exactly once and correct permanently.
In transit, the panel and the API are TLS only, with strict transport security preloaded and no downgrade path left open. Management interfaces sit on an out-of-band network with no public route, reachable through an authenticated tunnel and by no other means.
People, and researchers
Access is the attack surface nobody puts on a specification sheet.
Nobody holds standing access
Production access is requested, time-boxed and expires on its own. There is no permanent administrative session anywhere in the platform.
Two people, or nothing
Any action touching customer data needs approval from somebody who did not request it, and the approval is recorded with the reason given.
Hardware keys only
Staff authenticate with a hardware security key from a managed machine. A password on its own opens nothing, and personal devices are not on the list at all.
Guests stay closed
Support cannot open your console, read your volume or attach to your memory without the instance being paused and the action written to a record you can read afterwards in the panel.
Leaving is immediate
Access is revoked at the end of the final shift and keys are removed from the fleet the same hour. The change is auditable, and it has been exercised four times.
- 01
Report it
Mail the security address, encrypted to the published key where the finding warrants it. A proof of concept is welcome. Raw scanner output with no analysis attached is not.
- 02
We acknowledge inside a day
From a human rather than a ticket robot. The median across the past year has been under four hours.
- 03
We triage in three working days
With a severity, a plan and a date. Where we disagree with your severity we say so and explain why, rather than quietly downgrading it and hoping you stop reading.
- 04
We fix, and we tell you
Critical findings are patched out of band. Everything else ships in the next monthly cycle, and you hear about it on the day it lands.
- 05
Publish whenever you like
No embargo demanded, no legal threat, no obligation to coordinate. Ninety days is requested for anything that would expose customers before a fix exists, and we have never had to ask twice.
- 06
You get paid
In credit or in coin, whichever you prefer, scaled to severity rather than to how loudly the report was written. No upper band is published, because we would rather be surprised than capped.
Testing is welcome against your own instances and against the panel. It is not welcome against another customer’s instance, and that line is the whole of our safe-harbour position.
Break it, then tell us.
The security address and its key sit on the contact page. Findings that change how the platform works get named in the changelog, credited however the reporter asks to be credited, including not at all.