Security and Compliance

​

Platform security

​

Infrastructure security

• Geographically distributed data centers with physical access controls
• 24/7 monitoring and surveillance
• Redundant power and networking systems
• Environmental controls and fire suppression

• Network segmentation and isolation between tenants
• DDoS protection and traffic monitoring
• Encrypted communications between all internal services
• Regular security assessments and penetration testing

​

Data protection

• Each GPU instance runs in an isolated environment
• No shared memory or storage between tenant instances
• Network isolation between customer workloads
• Secure instance termination with data wiping

​

Access controls

• API key authentication - All API requests require valid API keys
• SSH key authentication - Public key authentication for GPU instance access
• No shared credentials - Each user has unique credentials
• Session management - Automatic session expiration and secure token handling

​

Compliance

​

SOC 2

• Security - Protection against unauthorized access
• Availability - System availability for operation and use
• Processing integrity - System processing is complete and accurate
• Confidentiality - Information designated as confidential is protected
• Privacy - Personal information is collected and used appropriately

​

GDPR

• Data processing agreements (DPAs) upon request
• Data residency options for EU-based processing
• Support for data subject access requests
• Clear data retention and deletion policies

​

HIPAA

• Contact us to discuss your specific compliance requirements
• We can work with you on Business Associate Agreements (BAAs) for qualified use cases
• Enterprise customers may have access to dedicated, compliant infrastructure

​

Vulnerability reporting

​

How to report

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Any supporting evidence (screenshots, logs, etc.)

​

What to expect

1. Acknowledgment - We’ll acknowledge receipt within 48 hours
2. Investigation - Our security team will investigate the report
3. Updates - We’ll keep you informed of our progress
4. Resolution - We’ll work to resolve valid vulnerabilities promptly
5. Recognition - With your permission, we’ll acknowledge your contribution

​

Responsible disclosure

• Give us reasonable time to address the issue before public disclosure
• Avoid accessing or modifying other users’ data
• Act in good faith to avoid privacy violations and service disruptions

​

Best practices

​

API key security

# Set the environment variable
export HYPERBOLIC_API_KEY="your-api-key-here"

# Use in your application
import os
api_key = os.environ.get("HYPERBOLIC_API_KEY")

​

SSH key security

# Generate a secure Ed25519 key with a passphrase
ssh-keygen -t ed25519 -C "your-email@example.com"

​

Account security

• Use a strong, unique password - Don’t reuse passwords from other services
• Enable 2FA when available - Two-factor authentication adds an extra layer of security
• Review active sessions - Log out of sessions you don’t recognize
• Monitor billing - Set up alerts for unusual spending patterns
• Keep contact info current - Ensure you can receive security notifications

​

Instance security

• Keep software updated - Apply security patches to your instance OS and applications
• Use firewalls - Configure instance firewalls to allow only necessary traffic
• Don’t expose unnecessary ports - Only open ports required for your application
• Secure your applications - Follow security best practices for any services you deploy
• Clean up sensitive data - Remove sensitive files before terminating instances

​

Support

​

Next steps