Our commitment
Customers trust us with data and workloads that matter to them. We protect them with layered administrative, technical and physical safeguards that are proportionate to the risk, and we review those safeguards regularly. This page summarises our practices; specific commitments for a service are set out in the customer agreement.
Security principles
- Least privilege. People and systems get only the access they need, for as long as they need it.
- Defence in depth. No single control is relied on to protect customer data.
- Isolation by default. Each customer’s environment and data are kept separate.
- Accountability. Access and administrative actions are logged and reviewable.
Encryption
Data is encrypted in transit using current versions of TLS. Customer data stored in our managed environments is encrypted at rest. Encryption keys are protected and access to them is restricted.
Access control
Access to production systems requires individual accounts, strong authentication, including multi-factor authentication where supported, and approval based on role. Access is reviewed regularly and removed promptly when no longer needed. Our engineers access customer environments only to deliver the service or when the customer asks us to.
Tenant isolation
Rented GPU servers and clusters are dedicated to a single customer for the term of the rental. Managed AI services keep each customer’s data logically separated. Customer data is never shared with other customers or used to train models without the customer’s consent.
Monitoring and logging
We monitor our infrastructure for availability, performance and security events, and keep logs of access and administrative activity. Logs are protected against tampering and retained for a defined period.
Vulnerability management
We keep systems patched, harden configurations, and assess our infrastructure for vulnerabilities. Issues are prioritised by risk and fixed within defined timeframes.
Incident response
We maintain an incident response process to detect, contain, investigate and recover from security incidents. Where an incident affects personal data, we notify affected customers without undue delay. Where the law requires, we notify regulators — for example, the Personal Data Protection Commission within three calendar days of assessing that a breach is notifiable under Singapore’s PDPA, and the relevant supervisory authority within 72 hours of becoming aware of a breach under the EU GDPR.
Suppliers
We choose infrastructure and service providers with care, and require them by contract to protect data and use it only for the purposes we allow.
Data residency and deletion
We agree with each customer where their data is stored and processed. At the end of a rental or service term, customer data is securely erased from our systems, and storage media are sanitised before reuse or disposal, unless the customer asks us to return the data or the law requires us to keep it.
Reporting a security issue
If you believe you have found a security vulnerability in our website or services, please email [email protected] with “Security” in the subject line. Please give us reasonable time to investigate and fix the issue before disclosing it, and do not access or modify data that does not belong to you.