Security

1. Overview

At VoltageGPU, security is a core priority. We implement industry-standard security measures to protect your data, workloads, and infrastructure. This page provides transparency about our security practices for CTOs, RSSIs, and security-conscious teams.

2. Data Encryption

2.1 Encryption in Transit

• TLS 1.3: All communications are encrypted using TLS 1.3
• HTTPS Only: All API endpoints and web interfaces require HTTPS
• Certificate Management: Automated certificate renewal via Let's Encrypt

2.2 Encryption at Rest

• Database: All database data is encrypted at rest using AES-256
• Backups: Encrypted backups with separate key management
• Secrets: Environment variables and API keys stored in encrypted vaults

2.3 Secret Management

• API keys are hashed using bcrypt before storage
• Secrets are never logged or exposed in error messages
• Regular rotation of internal service credentials

3. Infrastructure Isolation

3.1 Compute Isolation

• Container Isolation: Each GPU pod runs in an isolated container environment
• Network Segmentation: Pods are isolated at the network level
• Resource Limits: Strict CPU, memory, and GPU resource limits per pod

3.2 Tenant Separation

• Logical Isolation: Complete data separation between customers
• No Shared Storage: Each tenant has dedicated storage volumes
• Namespace Isolation: Kubernetes namespaces for workload separation

4. Logging & Audit

4.1 What We Log

• Authentication events (login, logout, failed attempts)
• API requests (endpoint, timestamp, response code)
• Resource provisioning and deprovisioning
• Billing and payment events
• Administrative actions

4.2 Log Retention

• Security Logs: 12 months
• Access Logs: 90 days
• Audit Logs: 24 months

4.3 What We Don't Log

• Passwords or authentication tokens
• Full credit card numbers
• Customer workload data or model outputs

5. Authentication & Access Control

5.1 User Authentication

• Password Requirements: Minimum 8 characters, complexity enforced
• Password Storage: bcrypt hashing with salt
• Session Management: Secure, HTTP-only cookies with expiration
• Email Verification: Required for account activation

5.2 API Authentication

• API Keys: Unique per user, revocable at any time
• Rate Limiting: Protection against brute force attacks
• IP Allowlisting: Optional IP restrictions for API access

5.3 Internal Access

• Principle of least privilege for all internal systems
• Multi-factor authentication required for admin access
• Regular access reviews and deprovisioning

6. Security Practices

6.1 Vulnerability Management

• Dependency Scanning: Automated scanning of all dependencies
• Security Updates: Critical patches applied within 24-48 hours
• Regular Audits: Periodic security assessments

6.2 Secure Development

• Code review required for all changes
• Automated security testing in CI/CD pipeline
• Input validation and output encoding
• Protection against OWASP Top 10 vulnerabilities

6.3 Backup & Recovery

• Database Backups: Daily automated backups
• Retention: 30-day backup retention
• Recovery Testing: Regular disaster recovery drills

7. Shared Responsibility Model

8. Incident Response

• Detection: 24/7 monitoring and alerting
• Response Time: Critical incidents addressed within 1 hour
• Communication: Affected customers notified within 24 hours
• Post-Incident: Root cause analysis and remediation

9. Compliance

• GDPR: Full compliance with EU data protection regulations
• PCI DSS: Payment processing via PCI-compliant providers (Stripe)
• Data Residency: EU data processing available upon request

10. Security Contact

To report a security vulnerability or concern, please contact us at:

We appreciate responsible disclosure and will acknowledge receipt within 24 hours.

11. Updates

This security page is reviewed and updated regularly to reflect our current practices.

Last Updated: January 2025