Security & compliance, designed in — not bolted on

Every action on VxCloud is tied to an authenticated identity. Tenants federate their corporate IdP, enforce MFA on sensitive paths, and scope what each role can see and change down to a single resource.

• SAML 2.0 and OpenID Connect SSO with Okta, Azure AD, Google Workspace, JumpCloud, OneLogin
• TOTP and WebAuthn multi-factor authentication, enforced per-role
• Fine-grained role-based access control (RBAC) at workspace, project, and resource scope
• Short-lived API tokens scoped to a single workspace; rotation without downtime
• Just-in-time access requests with approval workflows for production resources

Data is encrypted at rest with AES-256 and in transit with TLS 1.3 — between your browser and VxCloud, between control-plane services, and between control plane and tenant nodes. Customer-managed encryption keys (CMK) are available on enterprise plans.

• AES-256-GCM at rest across managed databases, object storage, and Vault data
• TLS 1.3 with modern cipher suites; HSTS and forward secrecy on all public endpoints
• mTLS between control-plane services and tenant InstaNodeBox agents
• Customer-managed keys via AWS KMS, Azure Key Vault, GCP KMS, or self-hosted Vault Transit
• Encrypted backups stored across two geographic regions with versioned recovery

Secrets, SSH key pairs, registry credentials, and API tokens never live in plaintext. VxCloud stores them in a per-tenant HashiCorp Vault namespace and resolves them just-in-time during deployments — your code stays clean of credentials.

• HashiCorp Vault per workspace with KVv2, AppRole, and JWT auth methods
• Dynamic secrets for databases, cloud providers, and Git providers
• SSH key pairs generated and stored server-side; private keys never leave Vault
• Docker registry credentials resolved at deploy time, scrubbed from container env
• Audit-trail of every secret read and write, retained 90+ days

Tenant workloads run on isolated VPCs with security groups locked down by default. Inter-service traffic uses private routes; inbound exposure is opt-in per port. WAF and DDoS protection sit at the edge.

• Per-tenant VPCs and subnets across Alibaba, AWS, Azure, Google Cloud, Linode, and bare metal
• Default-deny security groups; ports opened explicitly via the deployment wizard
• WAF rules for OWASP Top 10, bot mitigation, and rate limiting on edge endpoints
• DDoS protection via Cloudflare and provider-native scrubbing
• Optional VPN and VPC-peering for private connectivity between your network and VxCloud

Every privileged action — provisioning, role changes, secret reads, deploys — is recorded in an append-only audit log. Stream the log to your SIEM, search it from the UI, and prove control activity to auditors.

• Append-only audit trail with cryptographic hash chaining
• Real-time WebSocket stream and REST API for SIEM ingestion (Splunk, Datadog, ELK)
• Per-event tenant, actor, resource, and IP attribution
• Configurable retention from 90 days (default) up to 7 years for regulated tenants

Every container image we publish is signed and scanned. Tenant deployments run on hardened OS images with patched kernels. Supply-chain attestations are produced and recorded so you can verify what ran where.

• Image signing with cosign; SBOMs generated for every release
• Hardened Ubuntu LTS base images, weekly patch cadence, automated CVE triage
• Container vulnerability scanning before deploy; high-severity CVEs block promotion
• Read-only root filesystems and dropped Linux capabilities by default
• Reproducible builds for the VxCloud control plane and CLI