Security and compliance, stated plainly.
What we have finished, what we are working on, and what is still planned. We update this page as work completes, and we do not mark anything done early.
Registrations and audits.
An item is marked complete only when the registration is issued or the final audit report is in hand.
| Framework | Scope | Relevant to | Status |
|---|---|---|---|
| SAM.gov registrationFederal | Unique Entity ID, CAGE code, and NAICS registration for federal awards. | Federal | Planned |
| SOC 2 Type IICommercial and public sector | Independent audit of security, availability, and confidentiality controls over an observation period. | Commercial and public sector | Planned |
| NIST SP 800-171Defense industrial base, federal | Controls for protecting Controlled Unclassified Information in non-federal systems. | Defense industrial base, federal | Planned |
| CMMC Level 2Department of Defense | DoD certification for contractors that handle CUI, built on NIST SP 800-171. | Department of Defense | Planned |
| FedRAMP ModerateFederal civilian and defense | Federal authorization for cloud services that process moderate-impact data. | Federal civilian and defense | Planned |
| Small business certificationFederal, state | SBA program eligibility for set-aside contracting. Program to be confirmed. | Federal, state | Planned |
The controls we are building.
Our program is designed against NIST SP 800-171 and the SOC 2 trust services criteria, so the same controls serve commercial and public-sector customers.
Access control
Single sign-on with multi-factor authentication for all staff systems, least-privilege roles, and logged administrative sessions.
Tenant isolation
Dedicated hardware per GPU customer and network segmentation between every customer environment.
Encryption
TLS for data in transit to our services, and encryption at rest for block, object, and file storage.
Personnel
Background checks for staff with facility or system access, and security training at hire and every year after.
Vulnerability management
Continuous scanning of our infrastructure, a defined patch schedule, and independent penetration testing.
Incident response
A written response plan, tested in exercises, with customer notification timelines set in every agreement.
Who manages what.
Responsibility depends on how you run your workloads. This is the default split. Agreements can adjust it.
| Layer | Bare-metal GPU | Managed Kubernetes or Slurm | Cloud VMs |
|---|---|---|---|
| Facility, power, and cooling | ECM | ECM | ECM |
| Physical hardware | ECM | ECM | ECM |
| Network fabric and isolation | ECM | ECM | ECM |
| Operating system | You | ECM | You |
| Drivers, CUDA, and NCCL | Shared | ECM | You |
| Kubernetes or Slurm control plane | You | ECM | You |
| User identities and access | You | Shared | You |
| Workloads and data | You | You | You |
Documents for your security review.
As each document is completed, it becomes available to customers and prospective customers under NDA.
- SOC 2 Type II reportPlanned
- System security plan (NIST SP 800-171)Planned
- Penetration test summaryPlanned
- Business continuity and disaster recovery planPlanned
- Certificate of insurancePlanned
Report a security issue.
If you believe you have found a vulnerability in our website or services, please report it to us privately so we can fix it before it is disclosed.
Use our contact form, choose “Something else,” and start your message with “Security report.” Include a description of the issue and the steps to reproduce it.
- We will acknowledge your report and keep you informed as we investigate.
- We will not pursue legal action for good-faith research that follows this policy.
- Please do not access or modify other people's data, degrade service, or disclose the issue before it is fixed.