Security
Isolated by design.
Each machine is a hardware-isolated virtual machine on EU servers, gone when the job is done.
- 1 VM
- per machine, with its own kernel
- EU
- where machines and data live
- TLS
- for all dashboard and API traffic
Isolation
- Hardware isolation
- Every machine is its own virtual machine with its own kernel. Other accounts cannot see or reach it.
- Disposable disks
- When a machine ends, its disk is destroyed. Nothing carries over to the next machine.
Data
- European infrastructure
- Runs on European infrastructure, not AWS, Azure, or Google Cloud.
- Stays in the EU
- Machines run on servers in the European Union. Disks, output, logs and images are stored there.
- Encrypted in transit
- Every connection to the site, the dashboard and the API uses TLS.
Access
- Passwords and API keys
- Passwords are securely hashed. API keys are shown once when created and are not stored in recoverable form.
- Activity log
- Sign-ins, failed sign-ins and account changes are visible under Activity for 12 months.
- Operational access
- Privileged production access is restricted and protected with multi-factor authentication.
Report a vulnerability
Email the steps to reproduce it. Our contact details are also in security.txt.
Report misuse
A Nitrous machine used for attacks, spam, malware or fraud. The rules are in the Acceptable Use Policy.