Infrastructure Security
gpuLabs operates across 40+ datacenters worldwide, all meeting industry-standard physical security requirements including 24/7 monitoring, biometric access controls, and redundant power systems. Our infrastructure partners maintain SOC 2, ISO 27001, and other relevant compliance certifications.
Network Security
- TLS Encryption: All API traffic is encrypted with TLS 1.3. Unencrypted HTTP requests are automatically redirected to HTTPS.
- SSH Access: GPU instances are accessible only via SSH key authentication. Password-based SSH is disabled by default.
- Rate Limiting: API endpoints are protected with rate limiting to prevent abuse and DDoS attacks.
- CORS Policy: API access is restricted to authorized origins.
Authentication & Authorization
- Password Hashing: All passwords are hashed using bcrypt with 12 salt rounds. Plaintext passwords are never stored or logged.
- API Keys: API keys are hashed with bcrypt before storage. The raw key is shown only once at creation and cannot be retrieved.
- JWT Tokens: Access tokens expire after 15 minutes. Refresh tokens expire after 7 days and are single-use.
- Role-Based Access: Admin endpoints are protected by role-based access control (RBAC). Regular users cannot access administrative functions.
- Account Lockout: Progressive lockout is enforced after repeated failed login attempts to prevent brute-force attacks.
Data Protection
- Instance Isolation: Each GPU instance runs in an isolated environment. Users cannot access other users' instances.
- Data at Rest: Database data is stored on encrypted volumes.
- No Content Inspection: We do not monitor, access, or inspect the contents of your instances or volumes.
- Ephemeral Storage: Data on GPU instances is ephemeral by design. When an instance is deleted, the underlying storage is wiped.
Payment Security
All card and PayPal payments are processed by Paddle.com Market Ltd, our Merchant of Record. Paddle is PCI DSS Level 1 certified — the highest level of payment security compliance.
- Card Data Isolation: Credit card numbers, CVVs, and payment credentials are collected and processed exclusively by Paddle. This data never reaches gpuLabs servers.
- Secure Checkout: Paddle's checkout is hosted on Paddle's PCI-compliant infrastructure, ensuring all payment data is encrypted end-to-end.
- Fraud Prevention: Paddle employs automated fraud detection, 3D Secure authentication, and chargeback protection on all transactions.
- Cryptocurrency: For crypto deposits (BTC, USDT TRC-20), transactions are verified on-chain. We do not collect or store any traditional payment data for crypto transactions.
Incident Response
In the event of a security incident:
- We will investigate and contain the incident immediately
- Affected users will be notified within 72 hours
- We will provide a post-incident report with remediation steps
- Relevant authorities will be notified as required by law
Responsible Disclosure
If you discover a security vulnerability, please report it to security@gpulabs.cloud. We appreciate responsible disclosure and will acknowledge your report within 48 hours.
Compliance
Our infrastructure and payment partners maintain the following certifications:
- SOC 2 Type II (infrastructure providers)
- ISO 27001 (infrastructure providers)
- PCI DSS Level 1 (Paddle — payment processing)
- GDPR compliant data processing (gpuLabs and Paddle)
- CCPA compliant (gpuLabs)
Bug Bounty
gpuLabs welcomes responsible security research and disclosure. If you believe you have found a vulnerability in our platform, we encourage you to report it.
Scope:
- gpulabs.cloud web application and API endpoints
- Authentication and authorization mechanisms
- Billing and payment integration
- Instance provisioning and management APIs
Out of Scope:
- Paddle.com checkout and payment infrastructure (report to Paddle directly)
- Third-party infrastructure provider systems
- Social engineering or phishing attacks against gpuLabs employees
- Denial-of-service (DoS/DDoS) attacks
- Vulnerabilities in software running on customer instances
Submit reports to security@gpulabs.cloud. Please include a detailed description, steps to reproduce, and any supporting evidence. We will acknowledge your report within 48 hours and aim to provide a resolution timeline within 5 business days.
Security Updates
We are committed to transparent communication about security-related changes:
- Critical Patches: Applied immediately. Affected users are notified via email within 24 hours.
- Planned Maintenance: Announced at least 48 hours in advance via the platform status page and email notifications.
- Security Advisories: Published on our status page when vulnerabilities are discovered and remediated.
- Infrastructure Updates: Routine security updates to dependencies and infrastructure components are applied on a rolling basis with no downtime where possible.
Contact
For security concerns, vulnerability reports, or questions about our security practices, reach out through any of the following channels:
For urgent security incidents, please include “URGENT” in your email subject line.