A control and a log for every layer.

Physical security

Each region runs in one data centre inside the EU: Tallinn, Riga, Copenhagen, Vienna, Milan and Lisbon. Our racks stand in space that only our staff and the site’s staff can enter. Entry takes a badge and a biometric check, and guards and cameras cover the site at every hour. A disk leaves a data centre only after it is wiped, or it is shredded on site.

Isolation

Each server is a virtual machine with its own kernel, memory and disk. A private network carries only the traffic of its project. Dedicated vCPUs give a server cores that no other customer shares.

A firewall runs on the host, outside the server, so a mistake inside the server cannot open a port the firewall keeps closed. Apply it by label, and every server with that label has its rules from first boot:

$ lc firewall create web --rules web.yaml
$ lc firewall apply web --label role=web
Applied web to web-1, web-2

Encryption at rest and in transit

Volumes, snapshots, backups and object storage are encrypted at rest with AES-256. The keys are held per project, apart from the data they protect. The console, the API and object storage accept only TLS, with TLS 1.2 as the lowest version. Private traffic between regions crosses our own links inside WireGuard tunnels.

Access and audit logs

Access to a project is by role, and sign-in to the console takes a second factor. An API token acts on one project, can be read-only, and can be revoked at any time. Every action on a project goes into its audit log, with the user or token, the address and the time. You can read and export the log from the console or the API.

Our engineers reach production through a bastion host with short-lived keys. Each session is recorded, and access to a customer’s data needs a ticket and a second engineer.

Audits and reports

Independent auditors check our controls every year. Their reports are available under NDA, and so are the results of our penetration tests. Ask for them at security@logi-ciel.co.

Responsible disclosure

If you find a vulnerability, write to security@logi-ciel.co with the steps to reproduce it. We reply within two working days and keep you informed until the fix ships. We take no legal action against research done in good faith that keeps to these rules:

• Test only resources in your own projects.
• Don’t read, change or delete other customers’ data.
• Give us time to fix the issue before you publish it.

Data processing agreement

The data processing agreement is part of the terms of service and applies to every account. It sets out what we do with personal data you store, where we keep it and who else may process it. You don’t need to sign a separate copy, though we send one on request.