Security
Built to be
honestly secure
Security here is a set of product controls described as they are, not as either side of a contract wishes they were. This is a practical overview of the platform, including the boundaries you still need to operate yourself.
Control boundaries
Identity
Roles, sessions, and TOTP
Secrets
Encrypted operational credentials
Workloads
Projects and private databases
Access and authentication
Who can reach what
Passwords that cannot be recovered
User passwords are hashed with PBKDF2-HMAC-SHA512 and never stored in recoverable form. A forgotten password is reset, not retrieved.
Keys and tokens held only as hashes
API keys and refresh tokens are stored as SHA-256 hashes with an indexable prefix. A lost key is replaced, and the stored hash cannot be replayed.
Sessions that rotate and revoke
Access tokens are short-lived and held in memory only. Refresh tokens rotate on every use in an httpOnly cookie, and presenting a revoked one revokes the entire family for that user.
Multi-factor authentication
Customers can enable TOTP on their accounts. Platform staff must complete TOTP before reaching the operator console, keeping tenant and staff access on separate paths.
Roles enforced by the API
Membership and platform roles are checked on every request, not only in the interface. Platform staff access is a separate, explicitly granted role that no API route can assign.
Encryption
In transit and at rest
TLS in transit
The control plane is served over HTTPS, and custom domains can request a Let's Encrypt certificate after DNS verification.
AES-GCM at rest
Infrastructure credentials, git connection tokens, managed database passwords, and per-app webhook secrets are encrypted at rest under a single key.
Write-only secrets
Environment variables marked secret are not returned by the dashboard or API after saving. The interface keeps a masked placeholder so a value can be replaced without revealing it.
Per-repository deploy keys
Git OAuth tokens stay in the control plane. Each application gets its own read-only Ed25519 deploy key, so a compromised build server yields access to one repository — not the customer's account.
Isolation and accountability
One tenant's data is no other tenant's data
A project per organization
Each organization is placed in its own deployment project. Managed databases are private to that project's applications by default; publishing a database port requires explicit confirmation.
Per-database credentials
Managed database credentials are generated per database and are never shared between organizations.
Backups in the platform's own storage
Scheduled backups for supported database engines are written to storage the platform operates, per server. Redis is not covered, and restoring a dump is a manual procedure.
Published ports are a deliberate boundary
An externally published database port is reachable from the public internet. Maxlayer makes that an explicit action, but network restrictions must be enforced on the server.
Actions are recorded
Sensitive tenant and platform actions are recorded by the control plane, giving operators a trace when support or incident work needs one.
Security posture
Specific before sweeping
Implementation-led claims
This page describes controls that exist in the product today. It is not a certification, compliance, or uptime attestation, and we do not use badges to imply one.
Questions deserve a direct answer
For a security questionnaire or a specific deployment concern, write to security@maxlayer.cloud. We will discuss the control you are evaluating instead of sending a generic trust-center checklist.
Shared responsibility
What is yours, what is ours, what is shared
Running applications securely is a joint effort. The model below sets out who is responsible for what, so neither side assumes the other is doing it.
You are responsible for
- —Protecting all secrets within your organization.
- —Managing and reviewing who can access your Maxlayer account.
- —Implementing data policies for what your application stores and transmits, and encrypting it where necessary.
- —Security of application-level configuration and code you deploy.
- —Regular security assessments of your own applications.
- —Endpoint protection of the workstations used to access Maxlayer.
- —Your own business-continuity and disaster-recovery plans.
- —Deleting your data on termination, and exporting what you need first.
We are responsible for
- —Operating the control plane and its deployment integrations.
- —Maintaining the organization, role, key, and session boundaries in the platform.
- —Encrypting operational credentials the platform stores.
- —Managing the deployment projects that host customer workloads.
- —Documenting the product controls and their practical limits.
- —Providing the paths to report security vulnerabilities and abuse.
We share
- —Diagnosing incidents, depending on whether the cause is in your code or the platform.
- —Reviewing access: we provide roles and API-key controls; you decide who receives them.
- —Recovery planning: we schedule supported database backups into storage we operate; you own the restore procedure.
- —Keeping application dependencies, configuration, and platform access current.
Reporting
Vulnerabilities and abuse
Vulnerability disclosure
Found a security issue in Maxlayer? Tell us at security@maxlayer.cloud before telling anyone else, and give us a reasonable window to respond. We will work with you in good faith, credit responsible disclosure where you would like it, and not pursue action against someone reporting in good faith.
Abuse
To report something hosted on Maxlayer — phishing, malware, or other abuse — email support@maxlayer.cloud with the hostname or URL and what you observed. Our Acceptable Use Policy describes how we enforce it.
Sub-processors
We use infrastructure providers to host your applications and deliver service emails, and PayPal to process payments. The current list is Annex A of our Data Processing Agreement.
Need something specific?
For a security questionnaire, a vendor review, or a due-diligence pack, write to security@maxlayer.cloud . For contractual terms, see our DPA; this page is a plain-language product overview, not a compliance attestation.
Deploy something today
Connect a repository, add credit, and let the build system work out the rest.
- GitHub + GitLab
- Container images
- OpenAI-compatible AI
- Pay as you run