> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sevalla.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These are the docs for Sevalla, a platform for deploying applications, databases, static sites, object storage and load balancers. The dashboard is at https://app.sevalla.com.
> Bold text in steps is an exact dashboard label.
> To act on a Sevalla account, prefer the Sevalla MCP server (https://mcp.sevalla.com/mcp, see https://docs.sevalla.com/ai-agents/overview.md), then the Sevalla CLI (https://docs.sevalla.com/developer-tools/cli.md), then the REST API (https://api-docs.sevalla.com, OpenAPI spec at https://api.sevalla.com/v3/openapi.json).
> Every page index is at https://docs.sevalla.com/llms.txt.

# Shared responsibility

> Which parts of security Sevalla handles and which you handle: infrastructure, network, accounts and access, code and dependencies, configuration, exposure, data and content.

Security on Sevalla is shared. Sevalla secures the platform your services run on: the cloud infrastructure, the clusters, the network and the edge. You secure what you deploy on it, who can reach it and who can change it.

## Who is responsible for what

| Area | Sevalla | You |
| - | - | - |
| Data centers and cloud infrastructure | Runs the platform in Google Cloud, Oracle Cloud Infrastructure (OCI) and Cloudflare | Nothing |
| Clusters, servers and the platform network | Operates, updates and monitors them | Nothing |
| Isolation between services | Runs each application and database in its own namespace, with traffic between namespaces denied by default | Add only the internal connections you need |
| Edge and DDoS protection | Routes all web traffic through Cloudflare's DDoS protection | Keep non-web endpoints (TCP proxies, external connections) closed unless you need them |
| Encryption in transit | Serves web traffic over HTTPS with SSL certificates for your domains | Use encrypted connections from your code to external services |
| Builds and runtime | Builds your source with the build strategy you choose and runs the result | Keep your code, dependencies and base images up to date and free of known vulnerabilities |
| Configuration and secrets | Stores environment variables and injects them into your processes | Keep secrets in environment variables, not in your repository, and rotate them |
| Resources and scaling | Runs the instances and sizes you choose | Choose sizes, instances and disks that fit your load |
| Network exposure | Enforces the IP restrictions you set | Decide what's public, and restrict who can connect |
| Databases | Runs the database engine and its backups | Manage your data, its users and who connects from outside. On OCI, add the backup targets the backups go to |
| Accounts and access | Provides two-factor authentication, single sign-on, roles and API keys | Protect your credentials, give each person the least access they need, and remove access when people leave |
| Content | Can remove content that breaks the Terms of Service | Everything you host and its compliance with the law and the [acceptable use](/security/acceptable-use) rules |

## Your responsibilities

### Accounts and access

Under the [Terms of Service](https://kinsta.com/legal/terms-service/), you keep your account secure, restrict access to it, and answer for everything done with it.

* Use a strong, unique password and an authenticator app for [two-factor authentication](/account/sign-in), or sign in through [single sign-on](/company/single-sign-on/overview).
* Give each person the [role](/company/users-and-roles) they need at the company, project or service level, and remove people who leave.
* Create [API keys](/developer-tools/api-keys) with only the permissions a script or agent needs, and rotate or delete keys you no longer use.
* Review the Git repository access you grant Sevalla. See [Git providers](/git/overview).

### Code, dependencies and configuration

You're responsible for your applications and their content: their design, code, changes, testing and performance. Sevalla has no obligation to monitor, check or correct your code or content.

* Keep frameworks, packages and Docker base images patched.
* Store secrets as [environment variables](/applications/environment-variables), never in your repository or image.
* Choose resources that fit your load. See [Scaling](/applications/scaling).

### Network exposure

* Expose only the processes and ports that must be public. TCP proxies and database external connections bypass Cloudflare: see [DDoS protection](/security/ddos-protection#what-is-not-covered).
* Use [IP restrictions](/applications/networking#ip-restrictions) on applications and databases that only some clients should reach.
* Connect your applications to databases over [internal connections](/applications/networking#internal-connections) instead of external connections.
* Don't rely on an egress IP address alone to identify your application to another service: the address is shared by other workloads in the same location. Prefer API keys or other credentials. See [Egress IP addresses](/applications/networking#egress-ip-addresses).

### Data

* Decide who can connect to each database from outside Sevalla, and with which credentials. See [Connect to a database](/databases/connect).
* Check that [backups](/databases/backups) cover what you need to restore, and keep your own exports of data you can't lose. A database in an OCI location has no backups until you add a backup target.

## Test the security of your application

The Terms of Service allow limited security and penetration testing of your own applications, under these rules:

* Email the schedule and scope of the test to [security@kinsta.com](mailto:security@kinsta.com) at least 7 days before it starts. The email is for monitoring and records: you won't get a reply.
* Test only your own applications, and don't affect any other system. Don't test the Sevalla dashboard, Sevalla's or Kinsta's websites, or other customers' services. Don't try to breach the sign-in, the Git authentication integration or the protections of the sign-up pages, or to bypass Cloudflare or reCAPTCHA.
* Sevalla doesn't support or advise on your test, and doesn't turn off any security measure for it.
* Send the results to [security@kinsta.com](mailto:security@kinsta.com) as soon as you have them. They're confidential information of Kinsta.

<Warning>
  Load testing of any kind isn't allowed on Sevalla.
</Warning>

If you find a vulnerability in Sevalla itself, [report it](/security/vulnerability-disclosure).

## If you suspect unauthorized access

The Terms of Service ask you to tell us right away about any security breach or unauthorized access you discover or suspect.

<Steps>
  <Step title="Tell Sevalla">
    In the dashboard, open the **Help** menu and click **Chat with support**, and describe what you saw.
  </Step>

  <Step title="Secure your account">
    Change your password, set up an authenticator app, and remove users you don't recognize in **User management**.
  </Step>

  <Step title="Replace credentials">
    Rotate your API keys in **Tools** > **API keys**, and change the secrets in your environment variables and database passwords.
  </Step>
</Steps>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.