Security

How we secure and protect your data. This is the short version. Contact us if you need more details.

Infrastructure

• Dedicated virtual servers at Hetzner in a United States data center. They run only Tnuki; no application runtime is shared with another organization.
• Inbound is default-deny at both the provider's network firewall and the host firewall, so the origin accepts no connections from the internet. The only path in is Cloudflare Tunnel, with TLS termination and WAF at the edge.
• Operator access runs over Cloudflare Zero Trust (WARP), a private network. No SSH or management port is exposed to the internet.

Encryption

• In transit: TLS 1.2 or later, HTTPS enforced at the edge. Origin and management traffic stays inside Cloudflare's encrypted tunnel and WARP.
• At rest: production disks use full-disk encryption (AES-XTS). The passphrase is typed at boot and is stored on no server and with no provider.
• Backups: encrypted with AES-256 on the host before upload, with the key managed separately from the storage credentials. The storage provider only ever sees ciphertext.

Access control

• Key-based only. Password authentication and root login are disabled on every server.
• People authenticate with non-exportable keys held in a Secure Enclave; each use needs a physical touch. Automation runs under its own OS identity with a four-hour grant that a person has to renew.
• Privilege elevation uses the same keys, so the audit log names the specific person or the automation identity. There is no shared admin account.
• Internal admin surfaces sit behind Cloudflare Access, restricted to named people. MFA is enforced on hosting, DNS, CDN, and email accounts.

Your data

• Each account's data is scoped server-side. A cross-account read fails closed.
• Subprocessors (LLM, web search, email, and infrastructure providers) are listed in our Privacy Policy. LLM providers process your content under their business terms, and nothing you put in Tnuki trains a model. Zero-data-retention processing with our primary LLM provider is in progress.
• Deletion on request. Per-conversation debug artifacts expire after 365 days.
• Secrets live in host environment files and provider secret stores, scoped per service. Nothing is in source control.

Backups and recovery

• Encrypted, deduplicated backups to off-site object storage every hour. Each one sits under a 30-day object lock (WORM), so a compromised host cannot delete or rewrite earlier backups.
• A weekly integrity check plus an automated restore drill. Both the hourly and weekly jobs report to a dead-man's switch that alerts us when a run is missed or fails.
• RPO about one hour. RTO about one hour: rebuild the host, restore the latest snapshot. The steps are written runbooks.

Monitoring

• Uptime and health checks run from a separate host at a separate provider. Alerts go out on multiple channels, and the monitor itself sits behind a dead-man's switch.
• Admin access and privileged server actions are logged.

Compliance

• SOC 2: on the roadmap, not yet attested.
• DPA: available on request.
• Questionnaires: send yours. We'll complete it and talk through anything it doesn't cover.
• Data residency: United States.

Contact

Security concerns, DPA requests, questionnaires, or anything on this page you want to dig into: security@tnuki.com.