> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sevalla.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These are the docs for Sevalla, a platform for deploying applications, databases, static sites, object storage and load balancers. The dashboard is at https://app.sevalla.com.
> Bold text in steps is an exact dashboard label.
> To act on a Sevalla account, prefer the Sevalla MCP server (https://mcp.sevalla.com/mcp, see https://docs.sevalla.com/ai-agents/overview.md), then the Sevalla CLI (https://docs.sevalla.com/developer-tools/cli.md), then the REST API (https://api-docs.sevalla.com, OpenAPI spec at https://api.sevalla.com/v3/openapi.json).
> Every page index is at https://docs.sevalla.com/llms.txt.

# Security

> How Sevalla secures your services: SOC 2 Type II and ISO 27001 compliance, the Trust Center, Cloudflare DDoS protection, encryption, isolation, and the access controls you manage.

Sevalla runs your applications and databases on Kubernetes clusters in Google Cloud and Oracle Cloud Infrastructure (OCI), and serves all web traffic through Cloudflare's network. Sevalla is operated by Kinsta Inc., whose security program is audited for SOC 2 Type II and certified to ISO/IEC 27001:2022, with Sevalla in scope.

## Compliance

| Standard | Status |
| - | - |
| SOC 2 Type II | Independent audit of how well the security controls worked over a period of time. Report available on request. |
| ISO/IEC 27001:2022 | Certified (information security management) |
| ISO/IEC 27017 | Certified (security controls for cloud services) |
| ISO/IEC 27018 | Certified (protection of personal data in the cloud) |
| CSA STAR Level 1 | Self-assessment published as a CAIQ v4.1.0 questionnaire |
| GDPR | Compliant. The [Data Processing Addendum](https://kinsta.com/legal/data-processing-addendum/) is part of your agreement. |
| CCPA | Compliant |

Sevalla's application hosting, database hosting and static site hosting, and the system architecture under them, are in scope for SOC 2, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and CSA STAR.

## Get the SOC 2 report and other documents

The [Kinsta Trust Center](https://trust.kinsta.com) holds every report and certificate. The ISO certificates are public: click **View** next to one. The SOC 2 Type II report, the 2026 penetration test report, the CSA STAR Level 1 CAIQ and the HECVAT Full need a request.

<Steps>
  <Step title="Open the documents">
    Go to [trust.kinsta.com/resources](https://trust.kinsta.com/resources) and click **Request access** next to the document you need.
  </Step>

  <Step title="Fill in the form">
    Enter your first name, last name, email, company name and the reason. Under **Access level**, keep **Full access** for every document, or pick **Limited access** and choose the documents.
  </Step>

  <Step title="Send the request">
    Click **Request access**.
  </Step>
</Steps>

The Kinsta team reviews requests within one business day and emails you access. If you haven't heard back after one business day, email [sales@kinsta.com](mailto:sales@kinsta.com).

## How Sevalla protects the platform

| Area | What Sevalla does |
| - | - |
| DDoS protection | All HTTP and HTTPS traffic to applications and static sites passes through Cloudflare, which mitigates attacks at layers 3, 4 and 7. See [DDoS protection](/security/ddos-protection). |
| Encryption in transit | Applications and static sites are served over HTTPS, with SSL certificates for your Sevalla and custom domains. Requests over plain HTTP are redirected to HTTPS. See [Custom domains](/domains/overview). |
| Encryption at rest | Datastores that hold sensitive customer data are encrypted at rest. |
| Isolation | Each application and each database runs in its own Kubernetes namespace. Traffic between namespaces is denied unless you add an [internal connection](/applications/networking#internal-connections). See [Infrastructure](/platform/infrastructure). |
| Staff access | Access to production systems, databases, networks and encryption keys is limited to authorized staff with a business need, each with unique credentials, and is revoked when they leave. |
| Testing | A penetration test runs at least once a year, and the vulnerabilities it finds are fixed under a remediation plan. Controls are also self-assessed at least once a year. |
| Continuity | Business continuity and disaster recovery plans are tested at least once a year. |
| People | Employees pass background checks and sign confidentiality agreements. |

## Security controls you manage

| Control | Where | Details |
| - | - | - |
| Two-factor authentication | **My account** | A code from an authenticator app, or by email, when you sign in. See [Sign-in and two-factor authentication](/account/sign-in). |
| Single sign-on (SAML) | **Single sign-on** | Sign in through your identity provider, optionally mandatory for everyone in the company. See [Single sign-on](/company/single-sign-on/overview). |
| Roles | **User management**, a project's **Access management** tab | Give each person access to the company, a project or single services, with the least access they need. See [Users and roles](/company/users-and-roles). |
| API keys | **Tools** > **API keys** | Keys with only the permissions a script or agent needs. Rotate or disable them when they're no longer needed. See [API keys](/developer-tools/api-keys). |
| IP restrictions | An application's or database's **Networking** tab | Allow or deny traffic from specific IP addresses and ranges. See [IP restrictions](/applications/networking#ip-restrictions) and [Restrict access by IP address](/databases/connect#restrict-access-by-ip-address). |
| Private networking | An application's **Networking** tab | Connect applications and databases over internal connections instead of public endpoints. See [Internal connections](/applications/networking#internal-connections). |

For the full split of duties, see [Shared responsibility](/security/shared-responsibility).

## Subprocessors

These subprocessors handle data for Sevalla. The [Trust Center subprocessor list](https://trust.kinsta.com/subprocessors) is always current.

| Subprocessor | Purpose | Location |
| - | - | - |
| Cloudflare | Security and performance | Regional |
| Google Cloud Platform | Hosting and security | The location you choose |
| Oracle America, Inc. (OCI) | Hosting and security | The location you choose |
| ClickHouse, Inc. | Analytics and log storage | United States |
| Intercom | Customer support and communication | United States |
| HubSpot | Customer support and communication | United States |
| Anthropic | AI-powered tooling and analytics | United States and Ireland |
| OpenAI | AI-powered tooling and analytics | United States and Ireland |

## Security policies

<Columns cols={2}>
  <Card title="Shared responsibility" icon="users" href="/security/shared-responsibility">
    What Sevalla secures and what you secure.
  </Card>

  <Card title="DDoS protection" icon="shield" href="/security/ddos-protection">
    Cloudflare's always-on protection and what it covers.
  </Card>

  <Card title="Report a vulnerability" icon="bug" href="/security/vulnerability-disclosure">
    How to report a security issue privately.
  </Card>

  <Card title="Acceptable use" icon="scale" href="/security/acceptable-use">
    Prohibited content and activity, sanctions and .ru domains.
  </Card>
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.