Security

// 01 — CONTROLS

• · Full-disk encryption on all servers
• · TLS 1.3 enforced on all management connections
• · SSH key-only authentication · brute-force blocking
• · Host firewall · minimal open ports · default-deny policy
• · Automated security patching
• · Audit logs for administrative actions
• · No third-party analytics scripts on the website

// 02 — TESTING

No third-party penetration test has been completed yet; one is planned before general availability. Internal weekly security scans across the fleet. Quarterly internal audit: open ports, SSH keys, brute-force blocking, certificate expiry.

// 03 — CONTACT

Vulnerability reports: security@sovereignhybridcompute.net

security.txt:      /.well-known/security.txt  (RFC 9116)
ack target:        72 hours
coordinated:       90-day disclosure window

// 04 — INCIDENT RESPONSE

Incidents are triaged by severity, worked by the people who run the infrastructure, and followed by a written post-incident report.

Customer-facing terms per the SLA. Beta posture: best-effort.