Security & access

Tenant isolation

Every tenant runs its own isolated stack — separate namespaces, databases, and networks. There is no shared blast radius between tenants.

That isolation is between tenants, not from marketplace operators: a rented server is the operator's own machine, and the operator can still reach it. Encrypt anything sensitive you keep on rented hardware.

Organizations & roles

Access is organized around organizations with five roles:

• Owner — full control, including billing and deletion.
• Admin — manage infrastructure and members.
• Member — day-to-day infrastructure work.
• Viewer — read-only access.
• Billing — invoices and payment methods only.

API tokens inherit these limits: a token is always capped at the role of the user who created it.

Sign-in

You sign in with a Google account, through the platform's identity provider, so access can be centrally granted — and centrally revoked. SAML and other identity providers are not supported yet.

Encryption

Cross-site traffic rides an encrypted overlay network, and credentials such as SSH keys are stored encrypted. TLS terminates at the edge for every public endpoint.

Audit trail

Because every change is an automation job, the job history shows what changed, when, and by whom. A record of API-token activity is kept for 90 days. Job history has no published retention period yet; ask us before you rely on it for compliance.