Security you can trust
Your servers and data are protected by industry-leading security practices. Built secure by default, not as an afterthought.
mTLS on Every Plan
Mutual TLS for the agent ↔ control-plane channel on every subscription tier. Per-agent certificates issued at install, end-to-end — never terminated at a third-party edge.
Configuration Drift Detection
Cloudnan tracks every package, service, container, and firewall rule it installs. Anything that changes outside the panel triggers an alert — you see what diverged, when, and from where.
Auditable Open-Source Agent
The binary that runs on your servers is on GitHub. Every cryptographic operation, every command path, every byte sent upstream — readable, forkable, verifiable.
SSH Key Management
Secure SSH key storage and management with support for ED25519 and RSA keys. No passwords stored.
Audit Logging
Complete audit trail of all actions. Know who did what, when, and from where with detailed logs.
Role-Based Access Control
Fine-grained permissions system. Control exactly what each team member can access and modify.
Zero Trust Architecture
Every request is authenticated and authorized. No implicit trust, even within the network.
Compliance Ready
Built to help you meet SOC 2, GDPR, and HIPAA requirements with built-in compliance features.
Our Security Practices
Comprehensive security across every layer of our platform
Data Protection
- AES-256 encryption at rest
- TLS 1.3 for data in transit
- Automatic certificate rotation
- Encrypted backup destinations
Access Control
- TOTP & email OTP 2FA
- Sign in with Google / GitHub
- Passkey (WebAuthn) support
- Per-org role-based access control
Infrastructure
- Agent connects outbound only — no inbound ports
- Private network for control-plane internals
- DDoS protection at the edge
- mTLS-terminated, no proxy interception
Operations
- Configuration drift detection on every connected server
- Full audit log of every panel action
- Open-source agent — auditable code path
- Responsible disclosure: <48h triage on security@
Auditable by design
Read every line that runs on your servers
The cloudnan-agent is open source. Security teams can read every cryptographic operation, every command-execution path, every byte sent upstream to the control plane. The proto file is the contract — what you see is what we collect.
Combined with mandatory mTLS on every plan, there is no part of the trust model you have to take on faith. You can build the binary yourself from the public source, install it, and verify the certificate fingerprint matches what your dashboard shows.
- Per-agent client certificates issued at install — never reused, never shared
- TLS 1.3 only, end-to-end, no Cloudflare or third-party proxy interception
- Agent connects outbound only — no inbound ports to open on your firewall
- Configuration drift detection flags any change made outside the panel
Responsible Disclosure
Found a security vulnerability? We appreciate your help in keeping Cloudnan secure. Please report any security issues to our security team and we'll work with you to resolve them quickly.
Put your servers on autopilot.
Connect your cloud account or bring any Linux server. Every change gets a preview and an undo, including the ones your AI agent makes.
- 7-day free trial
- No credit card
- Your provider bills your servers
- Cancel anytime
Running many client sites? Talk to us