Security
What we protect, and what we haven’t built yet.
Most security pages are a wall of badges. GPUVerse is early and holds no certifications, so this page does the opposite: it names the controls enforced in the API today, the ones still on the roadmap, and exactly where the line sits.
- identifygv_session · X-API-Key
- throttleper-account · per-IP
- authorizeadmin · member · viewer
- recordaudit · correlation id
default deny · no route reachable by omission
Control plane
Every control, sorted by whether it actually runs.
The left column is enforced in the GPUVerse API right now. The right column is designed and documented but not yet shipped, we would rather you plan around the gap than discover it.
- Session authentication
Better Auth issues the gv_session cookie; an authenticate() middleware runs behind a global Fastify preHandler, so no route is reachable unauthenticated by omission.
- API key authentication
X-API-Key credentials for server-to-server access. Keys are hashed before storage and the plaintext is shown exactly once at creation.
- Multi-factor authentication
TOTP second factor on top of password or OAuth sign-in, enrolled per account.
- Role-based access control
admin / member / viewer roles with real membership and invitation logic, enforced at the service layer rather than in route handlers.
- Brute-force lockout
Redis-backed and three-dimensional, per account, per IP, and per account+IP, using atomic counters over a 15-minute window (5 attempts per account, 20 per IP).
- Audit logging
Authentication and state-changing events recorded with a 30-day retention window.
- Secret redaction
Tokens and credentials are stripped from logs; every response carries a correlation ID and a sanitized error envelope that never leaks stack traces.
- No stored provider credentials
GPUVerse holds no cloud-provider keys at all today, there are no live provider integrations, so there is no credential store to breach.
Certification status
We hold none of these yet.
Certification is a roadmap item, not an attestation. If a vendor questionnaire needs a SOC 2 report, we do not have one, and we will tell you that in the call rather than after the contract.
- Not started
SOC 2 Type II
No audit has been performed. Evidence pipelines are not wired yet.
- Not started
ISO 27001
On the roadmap; no assessment scheduled.
- Alignment in progress
GDPR
A Data Processing Agreement template is drafted and available in enterprise conversations.
- Not certified
HIPAA
No BAA is offered today. Do not send PHI to GPUVerse.
- Out of scope
PCI DSS
GPUVerse never stores, processes, or transmits cardholder data, payments are delegated to Stripe.
Your data
Rights you can exercise, and how long we keep things.
Data subject rights
- AccessSelf-service in the dashboard or via the APIImmediate
- RectificationUpdate your profile in the dashboard or via the APIImmediate
- ErasureAccount deletion in settings, or via the API30 days
- PortabilityJSON export of your account data7 days
- RestrictionContact support to restrict processing30 days
- ObjectionContact support to object to specific processing30 days
Retention
- User accountsUntil deletion, then 30 days
- Recommendation and plan history2 years, then aggregated
- Audit logs30 days
- Cost recordsRetained as financial records
- API access logs13 months
We do not sell personal information, and workload descriptions are never used to train third-party models. The full detail lives in the privacy policy.
Coordinated disclosure
Found something? We want the report.
No legal threats, no silence. Test against your own account only, never another customer’s data, and we will work the issue with you.
- 01
You report it
Email gpuverse.ai@gmail.com with reproduction steps and the impact you observed.
- 02
We acknowledge in 24 hours
You get a human reply confirming receipt and the triage owner.
- 03
We update every 5 business days
Status updates continue until the issue is resolved or closed with a reason.
- 04
We disclose together
Public disclosure is coordinated with you, no sooner than 30 days after a fix ships. Credit always, unless you prefer otherwise.
Security questionnaires and reviews
We complete CAIQ and SIG-Lite questionnaires and will join a technical call. Answers reflect this page, current state, not aspiration.
Last reviewed July 22, 2026