Trust & security

This page sets out our approach to trust & security for the GPU servers we rent: how your workloads are isolated, who can reach your server and your data, how the network and payments are protected, and how we keep the service lawful. Good GPU cloud security starts with the hardware model, so we begin there. Where something is your responsibility rather than ours, we say so.

GPU cloud security starts with isolation

Every GPU we rent is a whole physical GPU assigned to one customer. We do not use vGPU slicing, MIG partitions or time-sharing, so there is no co-tenancy on your GPU: no other customer's process runs on it, shares its memory or competes for its compute.

• 8-GPU servers are bare metal. The entire machine is yours, with no hypervisor between your operating system and the hardware.
• Single-GPU plans are a dedicated VM with the full GPU passed through, so the GPU and all of its memory are attached to your VM alone.

If your security model requires the whole host, CPUs included, to be yours alone, choose an 8-GPU bare-metal server. Our article on dedicated vs shared GPUs explains the trade-offs of sharing a GPU.

Access and your data

You receive root access over SSH, authenticated by key. You decide which keys can log in, which users exist and what software runs. Keep your keys secure: you are responsible for activity on your servers. See our SSH access guide for key setup.

You keep all rights to the data you store. We do not access it except when necessary to operate or repair the service at your request, or when required by law. Two more points are worth stating plainly:

• Backups are your responsibility. Local NVMe storage is not backed up by us unless agreed in writing. Copy datasets, checkpoints and model weights you cannot recreate to storage you control.
• Disks are securely erased between customers. After you cancel, your server runs until the end of the paid month, then it is decommissioned and its disks are securely erased.

For personal data about you, such as account, billing and support records, our privacy policy explains what we collect and why. Our website uses no advertising or analytics trackers, we never sell personal data, and for form submissions we store only a salted hash of your IP address.

Network security and firewall guidance

DDoS mitigation covers every public IP address. It protects your server's connectivity, but it does not decide which ports are reachable. Each server has a public IPv4 address and an IPv6 /64, so a firewall is part of your setup:

• Deny inbound traffic by default and open only what you need, starting with SSH.
• Apply the same rules to IPv6 as to IPv4, because your server is reachable over both.
• Keep notebooks, TensorBoard and model endpoints off public ports. Reach them through an SSH tunnel, or put authentication in front of them.
• Check container port publishing. Docker writes its own firewall rules, so a published container port can be reachable even when your host firewall appears to block it.

See our networking and firewall guide for more. Private networking between your servers is available on request, so internal traffic does not need to cross public interfaces.

Payment security

Card payments are processed by our payment provider with 3-D Secure authentication. Crypto payments are invoiced in US dollars with the exchange rate locked at checkout. Every payment, by card or crypto, comes with an invoice. Refunds go back to the card you paid with or, for crypto, are paid at the original US dollar value, in USDC or the coin you used, to a wallet address you control and confirm in writing.

Payment links follow a written order confirmation. If you receive a payment request you did not expect, check with us through the contact form before paying. Our crypto payments page covers coins, networks and fees.

Compliance and acceptable use

GPU capacity is subject to export control and sanctions rules, and our servers must not be used for attacks, malware, illegal content or other abuse. Our acceptable use policy lists what is not allowed. We screen for sanctions risk and investigate reports of abuse.

Verification stays proportionate. Most orders need only an email address and a payment. We may ask for more for large orders, signals of fraud, a possible sanctions match, or when the law or a payment provider requires it. When we ask, we tell you exactly what we need and why, and the information is used only for that purpose.

Report a trust & security issue

If you find a vulnerability in our website or service, or see abuse coming from an IP address on our network, tell us through our contact form. Include as much detail as you can: the affected IP address or URL, the time, and steps to reproduce or evidence of the abuse. Please test only against servers you rent, do not access other people's data, and give us a reasonable chance to fix an issue before you disclose it publicly.