Security
Security
How the platform keeps your machines yours.
New vulnerabilities are published every day, and most attacks on them are automated. This is how Vallic Cloud is built, said plainly, so you can judge it for yourself.
No key logs in as root
Root cannot log in over SSH on any machine, and its password is locked. Password logins are off everywhere: only keys get in, Ed25519, ECDSA or RSA of at least 2048 bits.
Your keys never reach a privileged account. They go on your team's own unprivileged account, behind a command that opens a shell inside your environment's container and nothing else. The console rewrites that list on every pass, so a key you remove in the console is gone from the machine too. Every shell opened is in your team's activity log.
SSH never answers on port 22, where every scanner on the internet starts. Each project gets a port of its own, chosen at random when the project is created, so a scanner that finds one learns nothing about the next. Five failed logins in ten minutes and an address is banned for an hour.
Our own access
Our back office, and the account we log in to machines with, answer only from our own network, over our VPN. From anywhere else they are not there at all: the back office does not exist, and the port is closed.
Everything anyone at Vallic changes in the back office is recorded: who, when, and which fields changed, never their values. Every login to a machine is recorded too, ours included, with the key it used. A new key that can reach the machines alerts the whole team the moment it is added.
Of our people, only the DevOps team can log in to a machine, and they do it through MorphGate, the SSH client we build. They sign in with the team's key and are never shown it, and nobody adds a key of their own. When somebody leaves the team, the key is replaced.
The platform's own credentials are replaced on a fixed schedule, and we are alerted before one falls due.
The machine calls us, never the other way round
The agent on each machine opens every connection to the console, over HTTPS, at TLS 1.2 or later. The console does not log in to your machines.
A new machine is given a single-use token that lasts fifteen minutes, which it exchanges for one that belongs to that machine alone. We keep only a hash of either. The credentials that build and destroy machines at the provider never reach a machine.
The agent, and every tool it installs, is checked against a pinned SHA-256 checksum before it runs: on the first boot and on every update.
Secrets stay encrypted
Provider credentials, repository credentials, backup keys, database passwords and the variables you mark secret are encrypted with libsodium (XSalsa20-Poly1305), under a key held outside the database. A copy of the database on its own decrypts none of them.
A secret variable is written once and never shown again, in the console or the API. Only a team's Admins and Owners can replace one.
Closed unless it has to be open
Every machine is created with its firewall already attached, so there is no moment when it is unprotected. The rules follow what the machine does: only the machine in front answers on ports 80 and 443, and databases, caches, search, queues and workers answer nothing from the internet. An environment of several machines talks over a private network of its own.
Outbound mail on ports 25 and 465 is refused on every machine, so a compromised site cannot send spam from it; mail goes through authenticated submission on 587. With Restricted server access, a project's SSH port answers only the addresses you list.
In front of every site, the edge refuses the probes scanners send all day — dotfiles, path traversal, the files that betray a stack — before they reach your application.
Images we publish ourselves
Every image your environments run is published by us, at ghcr.io/vallic. Most are built here, with at most one upstream layer beneath ours; the few taken whole from their own projects are pinned and checked the same way.
New upstream releases are looked for every four hours, and every image is scanned for known vulnerabilities each week. Your containers run rootless, under your team's own account.
Accounts
Two-factor authentication is required for every account on the console. A team has four roles — Viewer, Developer, Admin and Owner — and nobody can grant a role above their own. Sensitive actions ask you to confirm it is you again.
API tokens belong to one team, expire after at most ninety days, and are kept only as a hash.
Backups
Backups are encrypted on the machine before they leave it. They go to two places off it — storage on the same continent as your machines, and a cold copy in the EU — and each copy has a key of its own, so one key opens one copy.
When a team leaves, its machines are destroyed, and the backups we hold are erased thirty days later.
Patching
Every machine installs the operating system's security fixes itself, every day — those and nothing else. Most take effect at once. A kernel fix waits for a restart, and a machine never restarts on its own, because that takes your sites down at a moment nobody chose: the console marks it, and you or we reboot it when it suits.
Shared work
We run the machines, the network, the container runtime and the platform's own software. You keep your application and its dependencies up to date: we do not change your code. What keeps our part current runs on its own, and a person reviews every change it proposes before it ships:
- Every day, the platform's own software is checked against published security advisories, and a fix is proposed the same day.
- Every day, every machine installs its operating system's security fixes.
- Every four hours, new releases of the images your environments run are looked for, built and tested; so are new releases of the proxy and log shipper on every machine, checked against the checksums their projects publish.
- Every week, every image is scanned for known vulnerabilities, and the platform's frameworks and libraries move to their new releases.
How we test it
Every change reaches production through a pull request, and its tests must pass first:
- Hundreds of test suites cover the platform piece by piece: provisioning, deploys, billing, backups, the firewall rules each machine gets.
- A security suite walks every address the console answers and checks who may use it; signs in as one team and tries to reach every other team's projects, machines and secrets; tries every API role against every endpoint; tries to change things without signing in; checks that sensitive actions cannot skip the second confirmation; and checks the platform only fetches from the places it means to.
- The agent on your machines is tested on its own, and the proxy it runs is started with the platform's real configuration before a new release of it is accepted.
- Every image is built and started, and runs its own checks, before it is published.
The services behind it
The platform stands on other companies' services: the infrastructure providers your machines run at, backup storage, the CDN, code hosting, payments and our company mail. Every account we hold with them signs in with a second factor, and with a FIDO security key wherever the service supports one. The full list of who processes your data, and where, is in the Data Processing Agreement.
Reporting a vulnerability
Write to contact@vallic.com with what you found and how to reproduce it, and give us time to fix it before you publish. If a breach affects your data, we tell you within 72 hours of learning of it. The same address is in our security.txt.
What we commit to in writing is in the Data Processing Agreement.