Secure by default.

// 01 — isolation by default

• Project databases use separate logical databases and login roles on shared private infrastructure. Dashboard and API access also depend on organization ownership checks.
• Every running container is kernel-isolated in its own lightweight VM. On a shared, auto-scaling database cluster, each app gets its own logical database and login role, with cross-tenant access revoked at the database.
• Private workload networking restricts access to databases and caches. Public application endpoints remain accessible unless you configure authentication or project protection.

// 02 — encryption everywhere

• TLS 1.2+ on every endpoint. Plain HTTP redirects to HTTPS.
• AES-256 encryption at rest for databases, object storage, caches, and backups.
• Secrets live in an encrypted vault and are injected into your apps at runtime — never written to code or config files.
• Custom-domain certificates require successful ownership and DNS validation. Keep validation records in place for renewal.

// 03 — account security

• Optional SMS two-factor authentication, enabled from account settings.
• JWT-based sessions; passwords are never stored in plaintext.
• API keys are stored as salted hashes — we keep a prefix for display and cannot recover the full key.
• CSRF protection on state-changing browser requests, plus platform-wide rate limiting.

// 04 — payments and identity

• Card processing is fully delegated to a PCI-DSS Level 1 certified payment processor. Card numbers never touch SetCloud servers.
• Identity verification is required for premium and aftermarket domain purchases. The processor holds verification documents; SetCloud keeps session identifiers and verification status.

// 05 — monitoring and response

• Application and access logs are retained for security analysis.
• Operational monitoring is separate from client views. The dashboard does not provide client-configured alerts or distributed tracing.
• Breach notification and privacy rights are described in the Privacy Policy.

// 06 — compliance, honestly

SetCloud holds no security certifications of its own today, and we won't put badges on this page that we haven't earned. Our infrastructure and payment partners maintain their own controls; those certifications do not certify SetCloud. Our data-handling terms and privacy rights are described in the policy — details in the Privacy Policy.

// 07 — responsible disclosure

Found a vulnerability? Email security@setcloud.com with a description, reproduction steps, and any supporting evidence. We acknowledge reports within two business days. Please hold public disclosure until we've had a reasonable chance to fix it.