Security
Security at Aloof
What the platform does today, and what it doesn't do yet.
This page lists what the platform does today and what it doesn't. We hold no certifications (no SOC 2, ISO 27001 or HIPAA) and we don't claim any.
Transport
- All public endpoints (site, API, MCP and apps) use HTTPS with automatically issued certificates. Certificates are only requested for hosts we know about (on-demand TLS is gated by an ask endpoint).
- Remote nodes connect to the control plane over WireGuard and expose no inbound management ports.
Secrets and data at rest
- App environment variables, registry credentials, git deploy keys and tokens are encrypted at rest (Fernet) and are write-only through the API.
- API keys, deploy tokens and session tokens are stored only as SHA-256 hashes.
- Off-site backups are encrypted on our server with AES-256-GCM before upload, so the storage provider only sees ciphertext. Platform secrets get a second, passphrase-derived key (scrypt).
Isolation
- Each instance runs in its own container with CPU and memory limits. Containers share the host kernel; there are no microVMs yet.
- Each account has its own private network. Other accounts can't route to or resolve your apps, and an integration test checks this.
- Only an app's HTTP port is reachable publicly, through the edge proxy. Managed Postgres has no public port.
Access and accountability
- HttpOnly, SameSite session cookies; cookie-authenticated writes require a CSRF header.
- Single-use, expiring magic links. OAuth 2.1 with PKCE for MCP clients; tokens are scoped and revocable.
- Deploy tokens can be scoped to one app with an expiry, and can't touch billing or auth.
- exec, console sessions, proxy sessions, restores, token creation and secret changes are written to a per-account audit log.
- Owner admin access requires an admin flag on the account, a separate admin token, and a session check that is ready for a second factor.
Backups and recovery
- Daily logical Postgres backups on the host, and daily encrypted copies off-site in a separate location (Helsinki), kept 7 daily / 4 weekly / 3 monthly.
- A weekly automated test restore. An alert fires if the newest off-site backup is older than 26 hours.
- Not yet: point-in-time recovery, replicas, multi-region failover.
Infrastructure and processors
- Compute and the control plane run on Hetzner Cloud in Nuremberg, Germany. Backups go to Hetzner Object Storage in Helsinki, Finland.
- Stripe processes payments; card data never reaches our servers.
Reporting a vulnerability
Email security@aloof.si with steps to reproduce. Please give us reasonable time to fix an issue before you disclose it. We don't run a paid bug bounty.