Skip to main content

Security

What we protect, and what we haven’t built yet.

Most security pages are a wall of badges. GPUVerse is early and holds no certifications, so this page does the opposite: it names the controls enforced in the API today, the ones still on the roadmap, and exactly where the line sits.

Read the privacy policy
request · authorizationenforced
  1. identifygv_session · X-API-Key
  2. throttleper-account · per-IP
  3. authorizeadmin · member · viewer
  4. recordaudit · correlation id

default deny · no route reachable by omission

Control plane

Every control, sorted by whether it actually runs.

The left column is enforced in the GPUVerse API right now. The right column is designed and documented but not yet shipped, we would rather you plan around the gap than discover it.

  • Session authentication

    Better Auth issues the gv_session cookie; an authenticate() middleware runs behind a global Fastify preHandler, so no route is reachable unauthenticated by omission.

  • API key authentication

    X-API-Key credentials for server-to-server access. Keys are hashed before storage and the plaintext is shown exactly once at creation.

  • Multi-factor authentication

    TOTP second factor on top of password or OAuth sign-in, enrolled per account.

  • Role-based access control

    admin / member / viewer roles with real membership and invitation logic, enforced at the service layer rather than in route handlers.

  • Brute-force lockout

    Redis-backed and three-dimensional, per account, per IP, and per account+IP, using atomic counters over a 15-minute window (5 attempts per account, 20 per IP).

  • Audit logging

    Authentication and state-changing events recorded with a 30-day retention window.

  • Secret redaction

    Tokens and credentials are stripped from logs; every response carries a correlation ID and a sanitized error envelope that never leaks stack traces.

  • No stored provider credentials

    GPUVerse holds no cloud-provider keys at all today, there are no live provider integrations, so there is no credential store to breach.

Certification status

We hold none of these yet.

Certification is a roadmap item, not an attestation. If a vendor questionnaire needs a SOC 2 report, we do not have one, and we will tell you that in the call rather than after the contract.

  • SOC 2 Type II

    No audit has been performed. Evidence pipelines are not wired yet.

    Not started

  • ISO 27001

    On the roadmap; no assessment scheduled.

    Not started

  • GDPR

    A Data Processing Agreement template is drafted and available in enterprise conversations.

    Alignment in progress

  • HIPAA

    No BAA is offered today. Do not send PHI to GPUVerse.

    Not certified

  • PCI DSS

    GPUVerse never stores, processes, or transmits cardholder data, payments are delegated to Stripe.

    Out of scope

Your data

Rights you can exercise, and how long we keep things.

Data subject rights

  • AccessSelf-service in the dashboard or via the APIImmediate
  • RectificationUpdate your profile in the dashboard or via the APIImmediate
  • ErasureAccount deletion in settings, or via the API30 days
  • PortabilityJSON export of your account data7 days
  • RestrictionContact support to restrict processing30 days
  • ObjectionContact support to object to specific processing30 days

Retention

  • User accountsUntil deletion, then 30 days
  • Recommendation and plan history2 years, then aggregated
  • Audit logs30 days
  • Cost recordsRetained as financial records
  • API access logs13 months

We do not sell personal information, and workload descriptions are never used to train third-party models. The full detail lives in the privacy policy.

Coordinated disclosure

Found something? We want the report.

No legal threats, no silence. Test against your own account only, never another customer’s data, and we will work the issue with you.

  1. 01

    You report it

    Email contact@gpuverse.ai with reproduction steps and the impact you observed.

  2. 02

    We acknowledge in 24 hours

    You get a human reply confirming receipt and the triage owner.

  3. 03

    We update every 5 business days

    Status updates continue until the issue is resolved or closed with a reason.

  4. 04

    We disclose together

    Public disclosure is coordinated with you, no sooner than 30 days after a fix ships. Credit always, unless you prefer otherwise.

Security questionnaires and reviews

We complete CAIQ and SIG-Lite questionnaires and will join a technical call. Answers reflect this page, current state, not aspiration.

contact@gpuverse.ai

Last reviewed July 22, 2026