Bucharest, Romania (EU)
Cloud platform
Runs on our own hardware in a data center in Bucharest, together with the console and the API you manage it with.
- Cloud VMs
- Managed Kubernetes
- Block Storage
- Load Balancers
- Private networks
- Console and API
SECURITY AND TRUST
Security at RareCloud
What we protect, and where your data lives.
The controls we run today, service by service. Each one says which products it covers, because our cloud, our VPS and our object storage do not all run in the same place.
Data center in Bucharest (EU)
Our cloud network
Your project
- Cloud VMs
- Volumes
- Private network
- Firewall rules
Where Your Data Lives
It depends on the service. Here is each one, and where it keeps your data.
Account, billing and support
Stored in the EU
Your account details, invoices and support tickets are stored in the EU. Some of the providers we use, such as the live chat on our website, our payment processors and our team’s tools, are outside the EU; see our sub-processors.Object Storage
The region you choose for each bucket
A bucket stays in the region you create it in. Four of the 16 regions are in the EU:Amsterdam, EUFrankfurt, EUParis, EUMilan, EUThe others are in the UK, North America and Asia-Pacific. Regions are run by our object-storage partner.VPS
The location you choose when you order
Linux, Windows, n8n and OpenClaw VPS, in one of these 11 locations:Silicon ValleyPhoenixDallasNew YorkLondonThe HagueFrankfurtTimisoaraConstantaHong KongTokyoProxies
The country you select
Your proxy traffic leaves through the network and country you pick for it.
Kept Apart From Other Customers
On our cloud platform, every account works inside a project of its own.
Your project
- Private network
- Router
- Firewall rules
- Servers and volumes
- Credentials for this project only
Another customer's project
- Private network
- Router
- Firewall rules
- Servers and volumes
- Credentials for this project only
A project of your own
Your first cloud resource creates a project for your account, with its own private network, router and firewall group. Other customers' servers cannot join your private networks.
Credentials scoped to your project
For Cloud VMs, volumes, networks and load balancers, the console and the API act inside your project with credentials scoped to it.
Checked on every request
Our API checks that the account asking owns the resource it asks for.
One control plane per cluster
Each managed Kubernetes cluster has its own control plane, with its own API server and etcd.
How Your Data Is Encrypted
Our website, billing pages, console, API, object storage and Kubernetes endpoints use TLS. At rest, here is exactly what is encrypted, and by whom.
In transit
- Your browserrarecloud.ioWebsite and billingHTTP is redirected to HTTPS: HTTPS.
- Your browserconsole.rarecloud.ioConsoleHTTP is redirected to HTTPS: HTTPS.
- Your codeapi.rarecloud.ioAPIHTTP is redirected to HTTPS: HTTPS.
- Your S3 toolss3.<region>.rarestack.netObject StorageEvery request signed with your key: HTTPS.
- kubectlyour cluster's APIManaged KubernetesCredentials in your kubeconfig: TLS.
At rest
Kubernetes Secrets
Secrets stored in every managed Kubernetes cluster we run for you are encrypted at rest (AES-CBC), with keys generated and held by our platform.
Tokens and cloud credentials
API tokens are stored only as Argon2id hashes. The cloud credentials we hold on your behalf are encrypted with AES-256-GCM.
Object Storage and our backups
Your buckets, and our cloud platform's off-site backups, are kept with our object-storage partner, which states that it encrypts all the data it stores with AES-256.
Your Account, Under Your Control
What protects the console and the API you manage your services with.
Two-factor sign-in for the console
Turn on an authenticator app, and every console sign-in asks for a code from it.
Limits on failed sign-ins
Repeated failed sign-ins are slowed down, and each time the limit is hit it is recorded.
API tokens you can scope
Give each token only the scopes it needs and an expiry date, and revoke it at any time. The secret is shown once, when you create it.
Protected sessions
Sign-in cookies are HttpOnly and Secure, so scripts on a page cannot read them.
Support sign-ins are recorded
When our support team signs in to the console as you to help, the session is marked as theirs and recorded in our audit log.
How We Run Our Cloud Platform
How changes, access and backups work on the platform behind Cloud VMs, Kubernetes, volumes and load balancers.
Changes through pull requests
Most changes to our cloud platform are made in version control, as pull requests with automated checks and a written note on what each one changes in production, and automation applies them from the repository.
Key-based server access
Administrator access to our cloud servers uses SSH keys.
Off-site backups, in the EU
The platform's databases and cluster state are copied off site, in the EU, to a separate storage provider: cluster state four times a day, databases daily, and the console database with 30 days of point-in-time recovery.
Your data, your backups
We do not back up what is inside your servers and volumes. Take snapshots, or copy your data to object storage, to keep your own backups.
Who Takes Care of What
We take care of
- The hardware and network our cloud runs on, in a data center run by our data-center partner
- Keeping each customer's project apart from the others
- The console, the API, and the control planes of managed Kubernetes clusters
- Off-site backups of the platform itself
You take care of
- The operating system and software in your servers, and their updates
- Firewall rules and SSH keys for your servers
- Backups of your own data
- Your sign-in: a strong password, two-factor sign-in, and API tokens with only the scopes they need
- What runs in your Kubernetes clusters, and who can reach it
When Something Goes Wrong
On our cloud platform, every incident follows the same path and ends with a written post-mortem.
Detect
Alerts watch the platform's health, its capacity and the freshness of its backups.
Respond
We work the incident until the service is back, and keep a timeline as we go.
Write it up
A post-mortem records what happened, when, why, and who was affected.
Fix the cause
Its follow-ups go on our roadmap and are tracked until they are done.
If a personal data breach affects data we hold or process for you, we tell you without undue delay. For data we are responsible for as controller, such as your account and billing details, we also notify the Romanian data protection authority (ANSPDCP) where the GDPR requires it.
How Payments Work
Card payments are processed by Stripe, PayPal payments by PayPal, and cryptocurrency payments by CoinGate. Our console and API never receive or store your card number.
Console and API
Create the invoice. Never receive or store your card number.
Our billing page
Where you choose how to pay the invoice.
Stripe, PayPal or CoinGate
Process the payment.
Privacy and Compliance
GDPR
RareCloud is run by Rare Mood Agency SRL, a company registered in Romania, and handles personal data under the GDPR.
Read the Privacy PolicyDPA and sub-processors
A Data Processing Agreement is available on request. Our sub-processors are listed with what they do and where.
Request the DPASee sub-processorsSOC 2 and ISO 27001
We are working toward ISO/IEC 27001 certification and a SOC 2 Type II report.
Found a Security Issue?
Email security@rarecloud.io. Our disclosure policy sets out the scope, what we commit to, and safe harbor for good-faith research.
Other security questions, or a security review for your company: hello@rarecloud.io