Zero trust
No request is trusted for where it comes from. Every call to the platform and to your clusters carries a credential that is checked on arrival, and network allowlists narrow who can try without ever standing in for authentication.
Security & compliance
The answers, before you have to ask for them.
Most of a vendor security review is the same twenty questions. Here are ours, answered in public, with a questionnaire on request for the rest.
Your data stays in Europe.
Clusters run on dedicated hardware in Europe, not public cloud and not shared instances. Data written to a cluster stays in the region it was provisioned in, and we don’t replicate it elsewhere for our own convenience.
We are fully GDPR compliant. A data processing agreement is available on request, and our subprocessor list comes with the security questionnaire.
Residency
Europe
GDPR
Compliant
SOC 2
Built to SOC 2 controls · audit in progress
Infrastructure
Dedicated bare metal
Uptime SLA
99.9% monthly, with service credits
Zero trust, least privilege, short-lived credentials.
Every service we run is built on the same three principles, from the ones you use directly to the ones behind them.
Least privilege
Every identity gets what its job needs and nothing more. Organization roles keep cluster credentials away from anyone below Write. Prometheus splits pushing, querying and administration into separate credentials, and federated tokens earn a role by their claims, down to a single workload.
Short-lived credentials
Credentials expire rather than wait to leak. Sessions run on short-lived access tokens that refresh in the background, scripts and Terraform trade a revocable app password for those same tokens, and AI agents sign in through the browser. Prometheus workloads can push with tokens their own cluster issues and renews.
Controls
What you can configure, and what we guarantee.
Tenant isolation
Every cluster is dedicated to one organization. Nodes are not shared between customers and there is no multi-tenant index space to escape from.
Authentication you choose
Delegate OpenSearch access to your identity provider over OIDC or SAML, and let Prometheus accept tokens from your identity provider or your own Kubernetes clusters instead of passwords. Accounts support two-factor authentication, passkeys, and Google and GitHub sign-in.
Network restriction
Each endpoint takes its own IP allowlist, the cluster API and Dashboards separately, so exposure can be scoped to the networks that need it.
Credential rotation
Cluster credentials can be rotated at any time from the console, API or Terraform, without downtime and without contacting us.
Backups you hold
Snapshots go to an S3 bucket you own and control, on a schedule you set. Your recovery position doesn’t depend on your account with us staying open.
Encryption
Traffic to every endpoint is TLS-terminated with certificates we issue and renew, including for custom hostnames.
Five roles, each a superset of the last.
Organization roles are cumulative rather than a grid of independent permissions, which is simpler to reason about and easier to audit. Cluster credentials require Write; nobody below it can read them.
| Role | Can do |
|---|---|
| Read | View the organization, its clusters and its invoices. |
| Billing | Everything above, plus the billing portal and payment details. |
| Write | Everything above, plus create, change and delete clusters, and view or rotate cluster credentials. |
| Admin | Everything above, plus invite and remove members, change roles, and edit organization settings. |
| Owner | Everything above, plus grant ownership and delete the organization. |
99.9%, and a public record of it.
The uptime commitment is a monthly percentage backed by service credits, written into the terms rather than a marketing page. Every incident is published on our status page, including the ones nobody reported.
Maintenance happens inside a weekly window you choose, in UTC. Leave it unset and we work around your traffic instead.
Support response
Availability and support are separate commitments. Support is email on every tier, at [email protected], with these first-response targets.
| Severity | Response | Cover |
|---|---|---|
| Production cluster down | 1 hour | 24×7 |
| Production degraded | 4 hours | 24×7 |
| Non-production impaired | 12 hours | Business days |
| General guidance | 24 hours | Business days |
Need the long form?
We keep a completed security questionnaire, a DPA and a subprocessor list ready to send. Ask and we’ll send them over.