Trust & Security

Security & compliance, designed in — not bolted on

VxCloud is built by prodxcloud to host workloads that must be secure: regulated SaaS, financial systems, healthcare back-ends, and the operational tooling enterprises run their business on. This page documents how we protect your data, what we're certified against, and where your responsibility starts.

SOC 2 Type IIISO 27001HIPAA BAAGDPRPCI DSS L1

99.99%

Control-plane uptime SLA

24/7

Security operations on-call

<24h

Vulnerability acknowledgement

7 yrs

Audit-log retention available

Inherits the controls of the clouds, IdPs, and SIEMs you already trust

AWSAzureGCPLinodeAlibabaHashiCorp VaultOktaCloudflareDatadogSplunk

Choose how you run it

Flexible deployment & engagement options

Match the tenancy model and operator partnership to your regulatory scope. Move between models as your program matures.

Recommended

Multi-tenant SaaS

Shared control plane, dedicated tenant boundary

Per-tenant Vault namespace, VPC, and KMS scope — no cross-tenant data path
Standard SOC 2, ISO 27001, GDPR, and PCI DSS controls inherited by default
Production-ready in under one hour with SSO and audit-log streaming
24/7 platform on-call with public status page and incident runbooks

Single-tenant dedicated

Your own control plane on shared or dedicated infra

Dedicated database, Vault, and key-management hierarchy — no neighbor risk
Customer-managed encryption keys (CMK) via your AWS KMS, Azure Key Vault, or HSM
Choose your region; we pin all data, backups, and audit logs to it
Eligible for HIPAA, PCI DSS Level 1, and FedRAMP-aligned controls

Self-hosted (BYO infra)

Helm chart deploys into your own VPC or on-prem

Air-gapped install supported; no outbound internet dependency
BYO IdP, BYO secrets store, BYO SIEM — we ship adapters, not lock-in
FIPS 140-3 cipher suites and signed kernel modules available
Useful for sovereign, classified, and heavily regulated environments

Concierge security partnership

Hands-on security architect for your rollout

Dedicated security architect through onboarding and the first audit cycle
Threat-model review and tabletop incident exercise within 90 days
Custom controls mapped to your internal framework (NIST CSF, CIS, ISMS)
Quarterly security business review with metrics, posture, and roadmap

The six pillars of VxCloud security

Every feature on the platform is built against these six pillars. They map directly to SOC 2 trust service criteria, ISO 27001 Annex A, and the CIS Critical Security Controls.

Identity & Access

Every action on VxCloud is tied to an authenticated identity. Tenants federate their corporate IdP, enforce MFA on sensitive paths, and scope what each role can see and change down to a single resource.

SAML 2.0 and OpenID Connect SSO with Okta, Azure AD, Google Workspace, JumpCloud, OneLogin
TOTP and WebAuthn multi-factor authentication, enforced per-role
Fine-grained role-based access control (RBAC) at workspace, project, and resource scope
Short-lived API tokens scoped to a single workspace; rotation without downtime
Just-in-time access requests with approval workflows for production resources

Encryption Everywhere

Data is encrypted at rest with AES-256 and in transit with TLS 1.3 — between your browser and VxCloud, between control-plane services, and between control plane and tenant nodes. Customer-managed encryption keys (CMK) are available on enterprise plans.

AES-256-GCM at rest across managed databases, object storage, and Vault data
TLS 1.3 with modern cipher suites; HSTS and forward secrecy on all public endpoints
mTLS between control-plane services and tenant InstaNodeBox agents
Customer-managed keys via AWS KMS, Azure Key Vault, GCP KMS, or self-hosted Vault Transit
Encrypted backups stored across two geographic regions with versioned recovery

Secrets Management

Secrets, SSH key pairs, registry credentials, and API tokens never live in plaintext. VxCloud stores them in a per-tenant HashiCorp Vault namespace and resolves them just-in-time during deployments — your code stays clean of credentials.

HashiCorp Vault per workspace with KVv2, AppRole, and JWT auth methods
Dynamic secrets for databases, cloud providers, and Git providers
SSH key pairs generated and stored server-side; private keys never leave Vault
Docker registry credentials resolved at deploy time, scrubbed from container env
Audit-trail of every secret read and write, retained 90+ days

Network Isolation

Tenant workloads run on isolated VPCs with security groups locked down by default. Inter-service traffic uses private routes; inbound exposure is opt-in per port. WAF and DDoS protection sit at the edge.

Per-tenant VPCs and subnets across Alibaba, AWS, Azure, Google Cloud, Linode, and bare metal
Default-deny security groups; ports opened explicitly via the deployment wizard
WAF rules for OWASP Top 10, bot mitigation, and rate limiting on edge endpoints
DDoS protection via Cloudflare and provider-native scrubbing
Optional VPN and VPC-peering for private connectivity between your network and VxCloud

Audit & Visibility

Every privileged action — provisioning, role changes, secret reads, deploys — is recorded in an append-only audit log. Stream the log to your SIEM, search it from the UI, and prove control activity to auditors.

Append-only audit trail with cryptographic hash chaining
Real-time WebSocket stream and REST API for SIEM ingestion (Splunk, Datadog, ELK)
Per-event tenant, actor, resource, and IP attribution
Configurable retention from 90 days (default) up to 7 years for regulated tenants
Pre-built audit reports for SOC 2 CC6/CC7 and ISO 27001 A.12.4

Runtime & Supply Chain

Every container image we publish is signed and scanned. Tenant deployments run on hardened OS images with patched kernels. Supply-chain attestations are produced and recorded so you can verify what ran where.

Image signing with cosign; SBOMs generated for every release
Hardened Ubuntu LTS base images, weekly patch cadence, automated CVE triage
Container vulnerability scanning before deploy; high-severity CVEs block promotion
Read-only root filesystems and dropped Linux capabilities by default
Reproducible builds for the VxCloud control plane and CLI

Certifications & attestations

Independent auditors verify the controls behind VxCloud annually. Reports and attestation letters are available to customers under NDA via the trust portal.

SOC 2 Type II

Audited annually

Independent attestation of security, availability, and confidentiality controls. Reports available under NDA.

ISO 27001

Certified

Information security management system aligned to ISO/IEC 27001:2022 with continuous internal audit.

HIPAA

BAA-ready

Business Associate Agreement available on enterprise plans for healthcare and life-sciences workloads.

GDPR

Compliant

Data residency in EU regions, DPA available, and Subject Access Request workflow built into the dashboard.

PCI DSS

Service Provider Level 1

Annual ROC for the VxCloud platform; tenants who process cardholder data inherit network and access controls.

CSA STAR

Level 2 — Self-Assessment

Cloud Security Alliance STAR registry entry covering CCM v4 controls.

Where security teams get stuck

Common challenges — and how VxCloud answers them

Challenge

Engineering teams rotate fast; secrets sprawl across .env files, CI variables, and notebooks where nobody can find them — let alone revoke them.

How VxCloud solves it

A per-workspace HashiCorp Vault namespace stores every credential. Deployments resolve secrets just-in-time so code stays clean and revocation takes one click.

Challenge

Auditors ask for evidence that production access is least-privilege, MFA-enforced, and reviewed — and the screenshots take weeks to gather.

How VxCloud solves it

Append-only audit log captures every privileged action with actor, IP, and resource. Pre-built SOC 2 CC6 and ISO 27001 A.9 reports export in one click.

Challenge

Multi-region customers demand data residency guarantees, but your stack quietly replicates backups and logs across continents.

How VxCloud solves it

Pin tenant data, backups, and audit logs to one region. Control planes in US, EU, and Singapore; sub-processor list and SCCs published in the trust portal.

Challenge

A high-severity CVE drops on a Friday and nobody knows which images, clusters, or tenants are affected.

How VxCloud solves it

Continuous SBOM and CVE scanning per image, per cluster, per tenant. Weekly patch cadence with auto-generated tickets and one-click rolling restart.

Data residency & sovereignty

Pick where your workloads run and where their data lives. VxCloud control planes are operated in the US, EU (Frankfurt), and Singapore. Tenant resources can be pinned to any region offered by AWS, Azure, GCP, or your own bare-metal nodes — your data never leaves the region you choose, including backups.

EU customers

GDPR-compliant DPA, EU-based control plane, and Standard Contractual Clauses for any sub-processor transfers.

US customers

HIPAA BAA, CCPA disclosures, and FedRAMP-aligned controls for federal contractors.

APAC customers

Singapore PDPA, Australia Privacy Act, and India DPDP — data residency pinned to local regions.

Shared responsibility model

Like every multi-tenant cloud, VxCloud operates a shared responsibility model. Knowing where the line is helps you focus your own security work where it matters.

prodxcloud is responsible for

• Physical security of the control plane
• Operating system patching on managed nodes
• Encryption keys for the control plane (or your CMK)
• Availability of the dashboard and API
• Vault namespace integrity and backups
• Audit log durability and immutability

You are responsible for

• Strong passwords + MFA for your workspace users
• Least-privilege role assignments
• Application-layer security in code you deploy
• Configuration of WAF rules and security groups
• Data classification and retention policies
• Reviewing audit logs and acting on alerts

Real-world workloads

Built for the workloads regulators ask the hardest questions about

Regulated FinTech and SaaS

Process card data, KYC documents, and account-balance ledgers under PCI DSS Level 1 controls with tenant isolation, encrypted backups, and signed audit trails.

Healthcare and life sciences

Run EHR-adjacent workloads with HIPAA BAA, encrypted PHI at rest with CMK, and a documented breach-notification path. De-identification helpers built in.

Public sector and education

Sovereign data residency, FedRAMP-aligned controls for federal contractors, and air-gapped self-host for classified environments. SCCs for EU public bodies.

Manufacturing and OT bridges

Carry telemetry from factory PLCs and SCADA systems into the cloud over signed, identity-aware tunnels with strict egress allowlists and asset attestation.

Multi-tenant ISVs

Sell to enterprise customers with provable tenant isolation, per-tenant CMK, and exportable audit logs your customers can read into their own SIEM.

AI workloads with sensitive data

Fine-tune and serve models against private data with prompt scrubbing, output filtering, and policy-aware model routing — no training data leakage.

Talk to security

Request our security & compliance package

Send the questionnaire, certifications, and architecture deep-dive your team needs. Our security team replies within one business day with the documents and a 30-minute walkthrough offer.

SOC 2 Type II report and ISO 27001 certificate under NDA
GDPR Data Processing Agreement and Standard Contractual Clauses
HIPAA Business Associate Agreement for healthcare workloads
Architecture review against your tenant isolation and key-management needs

Responsible disclosure

Found a security issue in VxCloud? Email [email protected] with steps to reproduce. We acknowledge reports within 24 hours, triage within three business days, and credit researchers in our hall of fame after a fix ships. We do not pursue legal action against good-faith research that follows our disclosure policy.

Need our SOC 2 report or DPA? Our security team responds within one business day.

Contact security Enterprise overview