1. Overview
At VoltageGPU, security is a core priority. We implement industry-standard security measures to protect your data, workloads, and infrastructure. This page provides transparency about our security practices for CTOs, RSSIs, and security-conscious teams.
2. Data Encryption
2.1 Encryption in Transit
- TLS 1.3: All communications are encrypted using TLS 1.3
- HTTPS Only: All API endpoints and web interfaces require HTTPS
- Certificate Management: Automated certificate renewal via Let's Encrypt
2.2 Encryption at Rest
- Database: All database data is encrypted at rest using AES-256
- Backups: Encrypted backups with separate key management
- Secrets: Environment variables and API keys stored in encrypted vaults
2.3 Secret Management
- API keys are hashed (SHA-256) before storage; only the hash is kept
- Secrets are never logged or exposed in error messages
- Regular rotation of internal service credentials
3. Infrastructure Isolation
3.1 Compute Isolation
- Container Isolation: Each GPU pod runs in an isolated container environment
- Network Segmentation: Pods are isolated at the network level
- Resource Limits: Strict CPU, memory, and GPU resource limits per pod
3.2 Tenant Separation
- Logical Isolation: Complete data separation between customers
- No Shared Storage: Each tenant has dedicated storage volumes
- Namespace Isolation: Kubernetes namespaces for workload separation
4. Logging & Audit
4.1 What We Log
- Authentication events (login, logout, failed attempts)
- API requests (endpoint, timestamp, response code)
- Resource provisioning and deprovisioning
- Billing and payment events
- Administrative actions
4.2 Log Retention
The authoritative, category-by-category schedule is in our Privacy Policy. The summary below must match it; where the two ever differ, the Privacy Policy governs.
- Pod console / SSH logs, GPU telemetry, attestation reports: 30 days
- API request metadata (route, status, latency, token count, never the body): 90 days
- Security logs (authentication events, IP, user agent, admin actions): 12 months
4.3 What We Don't Log
- Passwords or authentication tokens
- Full credit card numbers
- Customer workload data or model outputs
5. Authentication & Access Control
5.1 User Authentication
- Password Requirements: Minimum 8 characters, complexity enforced
- Password Storage: bcrypt hashing with salt
- API Keys: shown once at creation, stored only as a SHA-256 hash and compared by hash on every request (bcrypt is for passwords, not for high-frequency API key checks)
- Session Management: Secure, HTTP-only cookies with expiration
- Email Verification: Required for account activation
5.2 API Authentication
- API Keys: Unique per user, revocable at any time
- Rate Limiting: Protection against brute force attacks
- IP Allowlisting: Optional IP restrictions for API access
5.3 Internal Access
- Principle of least privilege for all internal systems
- Multi-factor authentication required for admin access
- Regular access reviews and deprovisioning
6. Security Practices
6.1 Vulnerability Management
- Dependency Scanning: Automated scanning of all dependencies
- Security Updates: Critical patches applied within 24-48 hours
- Regular Audits: Periodic security assessments
6.2 Secure Development
- Code review required for all changes
- Automated security testing in CI/CD pipeline
- Input validation and output encoding
- Protection against OWASP Top 10 vulnerabilities
6.3 Backup & Recovery
- Database Backups: Daily automated backups
- Retention: 30-day backup retention
- Recovery Testing: Regular disaster recovery drills
7. Shared Responsibility Model
VoltageGPU Responsibilities
- Platform security and infrastructure protection
- Network security and DDoS protection
- Physical security of data centers (via partners)
- Security patching and updates
- Access control and authentication systems
- Encryption of data in transit and at rest
Customer Responsibilities
- Securing your account credentials
- Managing API key security and rotation
- Security of your workloads and applications
- Data classification and handling within your pods
- Compliance with acceptable use policies
- Reporting security concerns promptly
8. Incident Response
- Detection: 24/7 monitoring and alerting
- Response Time: Critical incidents addressed within 1 hour
- Communication: Affected customers notified within 24 hours
- Post-Incident: Root cause analysis and remediation
9. Compliance
- GDPR: French company under EU law, Article 28 processor terms in our DPA. We hold no compliance certification and do not claim one, see our trust page for exactly what we do and do not hold.
- PCI DSS: Payment processing via PCI-compliant providers (Stripe)
- Data Residency: EU data processing available upon request
10. Security Contact
To report a security vulnerability or concern, please contact us at:
We appreciate responsible disclosure and will acknowledge receipt within 24 hours.
11. Updates
This security page is reviewed and updated regularly to reflect our current practices.
Last Updated: June 2025