Security
Security by isolation.
Applications are separated by a virtual machine boundary rather than a process boundary. This page describes what is true of the platform today.
Security
Security by isolation.
The isolation boundary is a virtual machine, not a process. That is the same boundary large clouds use for untrusted multi-tenant workloads.
Firecracker microVMs
Each application runs inside its own hardware-virtualised microVM with a separate guest kernel.
Tenant isolation
Applications belonging to different accounts never share a guest kernel or a filesystem.
Encrypted secrets
Environment variables are encrypted at rest and injected into the VM at start, never written into build artifacts.
TLS everywhere
Every smolclouds.com subdomain and every custom domain is served over HTTPS with certificates issued and renewed automatically.
Runtime isolation
Snapshot memory shared between VMs is copy-on-write and read-only from the guest's perspective.
Network isolation
Each microVM gets its own network namespace; inbound traffic reaches the app only through the platform router.
Data location
You choose the region an application is deployed to, and its data stays in that region.
Security contact
Report a vulnerability to security@smolclouds.com. We respond to reports and will credit reporters who ask to be credited.
Reporting a vulnerability
Email security@smolclouds.com with a description and reproduction steps. We aim to acknowledge reports within two business days and will keep you updated until the issue is resolved.
Compliance status
SmolClouds does not currently hold a SOC 2, ISO 27001 or similar attestation, and we do not claim otherwise. If a formal audit is a requirement for your team, contact us and we will tell you honestly where we are.