Passkeys and two-factor
Accounts support passkeys, two-factor authentication, and sign-in with Google or GitHub, so there is a way in that does not rely on a password.
Security & compliance
The answers, before you have to ask for them
Most of a vendor security review is the same twenty questions. Here are ours, answered in public, with a questionnaire on request for the rest.
Your data stays in Europe
Clusters run on dedicated hardware in Europe, not public cloud and not shared instances. Data written to a cluster stays in the region it was provisioned in, and we don’t replicate it elsewhere for our own convenience.
We process personal data in line with the GDPR. A data processing agreement is available on request, and our subprocessor list comes with the security questionnaire.
Residency
Europe
GDPR
DPA available
SOC 2
Built to SOC 2 controls · audit in progress
Infrastructure
Dedicated bare metal
Uptime SLA
99.9% monthly, with service credits
Approach
Best practice, built in rather than bolted on
Security guidance has been stable for years: strong identity, no long-lived secrets, encryption in transit, no trust from network position, least privilege. It goes unfollowed when following it means extra work, so we did that work once, in the platform.
Passwordless token auth
Kubernetes workloads, CI jobs and identity providers present short-lived tokens in place of passwords. Scripts and AI agents get a short-lived token that carries the caller’s role.
Built-in and bring-your-own SSO
Sign in with your ClusterNest account with nothing to set up, or connect your own OIDC or SAML provider. SSO costs nothing extra on any tier.
TLS everywhere
Traffic to every endpoint is encrypted, custom hostnames included, with certificates we issue and renew.
IAM roles for S3 snapshots
On AWS, snapshots reach your bucket through an IAM role, so no access key has to be created or stored.
IP allowlists
The cluster API and Dashboards each take their own allowlist, so exposure can be narrowed to the networks that need it.
Zero trust, least privilege, short-lived credentials
Every service we run is built on the same three principles, from the ones you use directly to the ones behind them.
Zero trust
No request is trusted for where it comes from. Every call to the platform and to your clusters carries a credential that is checked on arrival, and network allowlists narrow who can try without ever standing in for authentication.
Least privilege
Every identity gets what its job needs and nothing more. Organization roles keep cluster credentials away from anyone below Write. Prometheus splits pushing, querying and administration into separate credentials, and federated tokens earn a role by their claims, down to a single workload.
Short-lived credentials
Credentials expire rather than wait to leak. Sessions run on short-lived access tokens that refresh in the background, scripts and Terraform trade a revocable app password for those same tokens, and AI agents sign in through the browser. Prometheus workloads can push with tokens their own cluster issues and renews, and a script or agent trades its token for a short-lived one that works on a single cluster.
Controls
What you can configure, and what we guarantee
Tenant isolation
Every cluster is dedicated to one organization. Nodes are not shared between customers and there is no multi-tenant index space to escape from.
Authentication you choose
Sign in with your ClusterNest account with nothing to set up, or delegate OpenSearch access to your identity provider over OIDC or SAML at no extra charge on any tier. Prometheus also accepts tokens from your identity provider or your own Kubernetes clusters instead of passwords, and your SAML or OpenID Connect provider can sign people in to its query UI. Accounts support two-factor authentication, passkeys, and Google and GitHub sign-in.
Network restriction
Each endpoint takes its own IP allowlist, the cluster API and Dashboards separately, so exposure can be scoped to the networks that need it.
Credential rotation
Cluster credentials can be rotated at any time from the console or the API, without downtime and without contacting us.
Backups you hold
Snapshots go to an S3 bucket you own and control, on a schedule you set. Your recovery position doesn’t depend on your account with us staying open.
Encryption
Traffic to every endpoint is TLS-terminated with certificates we issue and renew, including for custom hostnames.
Five roles, each a superset of the last
Organization roles are cumulative rather than a grid of independent permissions, which is simpler to reason about and easier to audit. Cluster credentials require Write; nobody below it can read them.
| Role | Can do |
|---|---|
| Read | View the organization, its clusters and its invoices. |
| Billing | Everything above, plus the billing portal and payment details. |
| Write | Everything above, plus create, change and delete clusters, and view or rotate cluster credentials. |
| Admin | Everything above, plus invite and remove members, change roles, and edit organization settings. |
| Owner | Everything above, plus grant ownership and delete the organization. |
99.9%, and a public record of it
The uptime commitment is a monthly percentage backed by service credits, written into the terms rather than a marketing page. Every incident is published on our status page, including the ones nobody reported.
Maintenance happens inside a weekly window you choose, in UTC. Leave it unset and we work around your traffic instead.
Support response
Availability and support are separate commitments. Support is email on every tier, at [email protected], with these first-response targets.
| Severity | Response | Cover |
|---|---|---|
| Production cluster down | 1 hour | 24×7 |
| Production degraded | 4 hours | 24×7 |
| Non-production impaired | 12 hours | Business days |
| General guidance | 24 hours | Business days |
Need the long form?
We keep a completed security questionnaire, a DPA and a subprocessor list ready to send. Ask and we’ll send them over.