Security
Built to be
honestly secure
Security here is a set of controls that actually exist, described as they are — not as either side of the contract wishes they were. What follows mirrors Annex B of our Data Processing Agreement, and where a control is not yet implemented, it is not listed.
Access and authentication
Who can reach what
Passwords that cannot be recovered
User passwords are hashed with PBKDF2-HMAC-SHA512 and never stored in recoverable form. A forgotten password is reset, not retrieved.
Keys and tokens held only as hashes
API keys and refresh tokens are stored as SHA-256 hashes with an indexable prefix. A lost key is replaced, and the stored hash cannot be replayed.
Sessions that rotate and revoke
Access tokens are short-lived and held in memory only. Refresh tokens rotate on every use in an httpOnly cookie, and presenting a revoked one revokes the entire family for that user.
Multi-factor authentication
Signing in requires a second factor alongside the password, and the recovery paths are themselves verified, so a lost device cannot become a lockout that social engineering opens.
Roles enforced by the API
Membership and platform roles are checked on every request, not only in the interface. Platform staff access is a separate, explicitly granted role that no API route can assign.
Encryption
In transit and at rest
TLS in transit
Traffic to your applications and to our API is served over TLS.
AES-GCM at rest
Infrastructure credentials, git connection tokens, managed database passwords, and per-app webhook secrets are encrypted at rest under a single key.
Write-only secrets
Environment variables you mark secret are never returned by the dashboard or the API once saved. The interface round-trips a masked list without ever holding the values.
Per-repository deploy keys
Git OAuth tokens stay in the control plane. Each application gets its own read-only Ed25519 deploy key, so a compromised build server yields access to one repository — not the customer's account.
Isolation and accountability
One tenant's data is no other tenant's data
A project per organization
Each organization runs in its own project on the host infrastructure. A database is reachable only from that tenant's own applications and has no public address unless an operator publishes one.
Per-database credentials
Managed database credentials are generated per database and are never shared between organizations.
Backups in your own storage
Scheduled backups are written to S3-compatible storage you provide and control. We hold no copy of your recovery data — only the schedule.
Restores that are tested
The restore path is documented and exercised on a schedule. A backup that has never been restored is an assumption, and we do not run on assumptions.
Limits that are enforced
A tier's CPU and memory are real container limits, and the disk figure a database tier states is enforced at the storage layer. A database cannot silently outgrow what it is billed for.
Audit trail
Administrative and tenant actions are written to an audit log, including actions taken by platform staff on a customer's behalf.
Compliance
Standards and attestations
ISO 27001
Our information security management system is certified against ISO/IEC 27001, covering the platform's control plane and deployment infrastructure.
SOC 2 Type 2
Our controls are independently attested under SOC 2 Type 2, covering the security, availability, and confidentiality trust services criteria.
HIPAA
A Business Associate Agreement is available to covered entities and their business associates. Write to security@maxlayer.cloud and we will route the review.
GDPR
EU, UK, and Swiss transfers are governed by the Standard Contractual Clauses in Annex C of our Data Processing Agreement, and the controls we operate are listed in Annex B.
Shared responsibility
What is yours, what is ours, what is shared
Running applications securely is a joint effort. The model below sets out who is responsible for what, so neither side assumes the other is doing it.
You are responsible for
- —Protecting all secrets within your organization.
- —Managing and reviewing who can access your Maxlayer account.
- —Implementing data policies for what your application stores and transmits, and encrypting it where necessary.
- —Security of application-level configuration and code you deploy.
- —Regular security assessments of your own applications.
- —Endpoint protection of the workstations used to access Maxlayer.
- —Your own business-continuity and disaster-recovery plans.
- —Deleting your data on termination, and exporting what you need first.
We are responsible for
- —Patching and securing the underlying operating systems and runtime.
- —Internal networking between services and databases.
- —Securing the infrastructure that hosts hardware, software, and facilities.
- —Managing the underlying servers, networks, and storage.
- —Keeping supported build runtimes current.
- —Operating the platform — middleware and integrated services.
- —Publishing documentation on the platform's security features.
- —Transparency about operational status and security incidents.
We share
- —Monitoring and responding to incidents, depending on where in the stack they occur.
- —Security awareness and training.
- —Cooperating on data-privacy obligations where each party has a role.
- —Regular review of security practices on both sides.
Reporting
Vulnerabilities and abuse
Vulnerability disclosure
Found a security issue in Maxlayer? Tell us at security@maxlayer.cloud before telling anyone else, and give us a reasonable window to respond. We will work with you in good faith, credit responsible disclosure where you would like it, and not pursue action against someone reporting in good faith.
Abuse
To report something hosted on Maxlayer — phishing, malware, or other abuse — email support@maxlayer.cloud with the hostname or URL and what you observed. Our Acceptable Use Policy describes how we enforce it.
Sub-processors
We use infrastructure providers to host your applications and deliver service emails, and PayPal to process payments. The current list is Annex A of our Data Processing Agreement.
Need something specific?
For a security questionnaire, a vendor review, or a due-diligence pack, write to security@maxlayer.cloud. The authoritative and binding description of our measures is Annex B of our DPA; this page is its plain-language companion.
Deploy something today
Connect a repository, add credit, and let the build system work out the rest.