Shared responsibility

Security on Sevalla is shared. Sevalla secures the platform your services run on: the cloud infrastructure, the clusters, the network and the edge. You secure what you deploy on it, who can reach it and who can change it.

​

Who is responsible for what

​

Your responsibilities

​

Accounts and access

Under the Terms of Service, you keep your account secure, restrict access to it, and answer for everything done with it.

• Use a strong, unique password and an authenticator app for two-factor authentication, or sign in through single sign-on.
• Give each person the role they need at the company, project or service level, and remove people who leave.
• Create API keys with only the permissions a script or agent needs, and rotate or delete keys you no longer use.
• Review the Git repository access you grant Sevalla. See Git providers.

​

Code, dependencies and configuration

You’re responsible for your applications and their content: their design, code, changes, testing and performance. Sevalla has no obligation to monitor, check or correct your code or content.

• Keep frameworks, packages and Docker base images patched.
• Store secrets as environment variables, never in your repository or image.
• Choose resources that fit your load. See Scaling.

​

Network exposure

• Expose only the processes and ports that must be public. TCP proxies and database external connections bypass Cloudflare: see DDoS protection.
• Use IP restrictions on applications and databases that only some clients should reach.
• Connect your applications to databases over internal connections instead of external connections.
• Don’t rely on an egress IP address alone to identify your application to another service: the address is shared by other workloads in the same location. Prefer API keys or other credentials. See Egress IP addresses.

​

Data

• Decide who can connect to each database from outside Sevalla, and with which credentials. See Connect to a database.
• Check that backups cover what you need to restore, and keep your own exports of data you can’t lose. A database in an OCI location has no backups until you add a backup target.

​

Test the security of your application

The Terms of Service allow limited security and penetration testing of your own applications, under these rules:

• Email the schedule and scope of the test to security@kinsta.com at least 7 days before it starts. The email is for monitoring and records: you won’t get a reply.
• Test only your own applications, and don’t affect any other system. Don’t test the Sevalla dashboard, Sevalla’s or Kinsta’s websites, or other customers’ services. Don’t try to breach the sign-in, the Git authentication integration or the protections of the sign-up pages, or to bypass Cloudflare or reCAPTCHA.
• Sevalla doesn’t support or advise on your test, and doesn’t turn off any security measure for it.
• Send the results to security@kinsta.com as soon as you have them. They’re confidential information of Kinsta.

If you find a vulnerability in Sevalla itself, report it.

​

If you suspect unauthorized access

The Terms of Service ask you to tell us right away about any security breach or unauthorized access you discover or suspect.