Operate

Security

How access, credentials, secrets and data are protected, your responsibilities, and how to report a vulnerability.

Shared responsibility

ClockingCloud is responsible for	You are responsible for
Securing the platform, API and GPU fleet.	Keeping API keys, passwords and private SSH keys secret.
Isolating your instances from other customers.	The content of your prompts, images and models, and having the rights to use them.
Encrypting traffic and stored credentials.	Least-privilege credentials for any bucket you connect.
Patching the base image and runtime.	The code in your `setup` steps and any dependencies it installs.

Account access

Passwords are at least 8 characters and are stored only as salted hashes.
Console sessions expire after 7 days and renew while you are active.
Google sign-in is supported. ClockingCloud never receives your Google password.
API keys are shown once, stored only as a hash, can expire, and can be revoked immediately.

Data in transit and at rest

The API, console and CLI use TLS. Plain HTTP is not accepted.
Secrets are encrypted at rest, write-only, and never returned by the API, printed in logs, or included in traces.
Replica local disk is ephemeral and erased when the replica stops.
Global Volumes are encrypted at rest.

A GPU attached to a replica is dedicated to that replica for as long as it runs. Replicas of different customers do not share a GPU. Replicas have no inbound network access except authenticated SSH, and outbound access is allowed so your setup steps can download dependencies.

SSH

SSH uses public-key authentication only. Password login is disabled. Only keys on your account are accepted, and you can remove a key at any time.

Connected bucket credentials

Create a dedicated credential for ClockingCloud with the minimum permissions.
Prefer read-only access and --read-only unless jobs write results back.
Scope it to one bucket or prefix, and rotate it by running clockingcloud secrets set again.

Securing CI/CD

Store CLOCKINGCLOUD_API_KEY in your CI secret store, scoped to the repository and branch that deploy.
Use one key per pipeline with a short expiry, and pin the CLI version and verify its checksum.
Do not run untrusted pull requests with access to the key.

Report a vulnerability

Email security@clockingcloud.com with a description, steps to reproduce and the affected resource. Do not access other customers’ data, degrade the service, or disclose the issue publicly before we have responded. We acknowledge reports and keep you updated until resolved.

For how ClockingCloud handles personal data, see the Privacy Policy.

Something unclear or missing? Email hello@clockingcloud.com.