Security

1. Overview

At VoltageGPU, security is a core priority. We implement industry-standard security measures to protect your data, workloads, and infrastructure. This page provides transparency about our security practices for CTOs, RSSIs, and security-conscious teams.

2. Data Encryption

2.1 Encryption in Transit

• TLS 1.3: All communications are encrypted using TLS 1.3
• HTTPS Only: All API endpoints and web interfaces require HTTPS
• Certificate Management: Automated certificate renewal via Let's Encrypt

2.2 Encryption at Rest

• Database: All database data is encrypted at rest using AES-256
• Backups: Encrypted backups with separate key management
• Secrets: Environment variables and API keys stored in encrypted vaults

2.3 Secret Management

• API keys are hashed (SHA-256) before storage; only the hash is kept
• Since October 23, 2026, a log line that names an API key shows only its first 8 characters
• Regular rotation of internal service credentials

3. Infrastructure Isolation

3.1 Compute Isolation

• Container Isolation: Each GPU pod runs in an isolated container environment
• Network Segmentation: Pods are isolated at the network level
• Resource Limits: Strict CPU, memory, and GPU resource limits per pod

3.2 Tenant Separation

• Logical Isolation: Complete data separation between customers
• No Shared Storage: Each tenant has dedicated storage volumes
• Namespace Isolation: Kubernetes namespaces for workload separation

4. Logging & Audit

4.1 What We Log

• Authentication events (login, logout, failed attempts)
• API requests (endpoint, timestamp, response code)
• Resource provisioning and deprovisioning
• Billing and payment events
• Administrative actions
• Errors, with a code (see 4.3 for what an error message can contain)

4.2 Log Retention

The authoritative, category-by-category schedule is in our Privacy Policy. The summary below must match it; where the two ever differ, the Privacy Policy governs.

• Pod console / SSH logs, GPU telemetry, attestation reports: kept for operational debugging; no automatic purge yet, deletion on request
• API request metadata (route, status, latency, token count; no request body in records written since October 23, 2026): kept with the account for billing and abuse prevention; no automatic purge yet, deletion on request
• Security logs (authentication events, IP, user agent, admin actions): kept to investigate security incidents; no automatic purge yet, deletion on request

4.3 Request Content in Logs

• Inference API (/v1) and Confidential AI Agents: since October 23, 2026, their logs record metadata (model, endpoint, token counts, cost, status, internal ids, the first 8 characters of the API key) and error codes
• voltagegpu.com/chat and app.voltagegpu.com: their logs record error codes, not request content; logs written before this update can quote part of a request until our hosting provider deletes them
• Our servers see each request in clear to relay it to the model; the Privacy Policy says what is kept and for how long

5. Authentication & Access Control

5.1 User Authentication

• Password Requirements: Minimum 8 characters, complexity enforced
• Password Storage: bcrypt hashing with salt
• API Keys: shown once at creation, stored only as a SHA-256 hash and compared by hash on every request (bcrypt is for passwords, not for high-frequency API key checks)
• Session Management: Secure, HTTP-only cookies with expiration
• Email Verification: Required for account activation

5.2 API Authentication

• API Keys: Unique per user, revocable at any time
• Rate Limiting: Protection against brute force attacks
• IP Allowlisting: Optional IP restrictions for API access

5.3 Internal Access

• Principle of least privilege for all internal systems
• Multi-factor authentication required for admin access
• Regular access reviews and deprovisioning

6. Security Practices

6.1 Vulnerability Management

• Dependency Scanning: Automated scanning of all dependencies
• Security Updates: Critical patches applied within 24-48 hours
• Regular Audits: Periodic security assessments

6.2 Secure Development

• Code review required for all changes
• Automated security testing in CI/CD pipeline
• Input validation and output encoding
• Protection against OWASP Top 10 vulnerabilities

6.3 Backup & Recovery

• Database Backups: Daily automated backups
• Retention: 30-day backup retention
• Recovery Testing: Regular disaster recovery drills

7. Shared Responsibility Model

8. Incident Response

• Detection: 24/7 monitoring and alerting
• Response Time: Critical incidents addressed within 1 hour
• Communication: Affected customers notified within 24 hours
• Post-Incident: Root cause analysis and remediation

9. Compliance

• GDPR: French company under EU law, Article 28 processor terms in our DPA. We hold no compliance certification and do not claim one, see our trust page for exactly what we do and do not hold.
• PCI DSS: Payment processing via PCI-compliant providers (Stripe)
• Data Residency: EU data processing available upon request

10. Security Contact

To report a security vulnerability or concern, please contact us at:

We appreciate responsible disclosure and will acknowledge receipt within 24 hours.

11. Updates

This security page is reviewed and updated regularly to reflect our current practices.

Last Updated: October 28, 2026