Security model

Where your data is

Fjordrun runs on Hetzner servers in Nuremberg, Germany (region nbg1). Your services, databases, volumes, builds and logs stay there. See Regions and Privacy and GDPR for the companies that process data on our behalf.

Isolation between teams

Each team is a tenant with its own Kubernetes namespace:

• Network policies deny all traffic by default. Pods may only talk to pods of the same project and environment, receive traffic from the ingress and the platform's monitoring, resolve DNS, and reach the internet. Private address ranges and the cloud metadata endpoint are blocked.
• Pod security: workloads run under Kubernetes' baseline Pod Security Standard (with restricted warnings and auditing). Service account tokens are not mounted into your containers.
• Quotas: a ResourceQuota and LimitRange per namespace, sized by plan, stop one team from using another's capacity.
• Builds run as separate, short-lived jobs in a dedicated build namespace, with resource limits. The variables and credentials a build needs are passed per build and removed when it ends.

Access control

• Every API request is scoped to the teams the caller belongs to. Resources of other teams are reported as not found.
• Team roles (viewer, member, admin, owner) control what each member can do. See Teams and roles.
• API tokens are scoped to a team or a single project; personal access tokens act as their user. Tokens are stored hashed. See API tokens.

Secrets

• Service variables and shared variables are encrypted at rest.
• The GitHub access token of a connected account is encrypted at rest and only used to list repositories, clone them for builds and register push webhooks.
• Generated passwords for templates (${{secret(N)}}) are random strings created on our servers when the service is created.

In transit

• The dashboard, API and all public domains use HTTPS with automatically issued certificates.
• Traffic between your services over the private network stays inside the cluster.

Payments

Card and payment data is handled by Stripe. Fjordrun does not see or store card numbers.

Your responsibilities

• Keep dependencies and base images up to date.
• Don't expose databases or tools without authentication (such as Ollama) through a public domain.
• Change default passwords of templates that have one (Umami).
• Keep your own backups of important data.

Reporting a vulnerability

Email support@fjordrun.com with the details. Please give us reasonable time to fix the issue before disclosing it.