Security

A machine of its own

Every sandbox and every Cube’s instance is a Firecracker microVM of its own, running one OCI image. Commands and files reach it through an agent inside the machine, not through its network. Everything in a sandbox belongs to one project.

Each microVM’s process runs in a jail of its own: its own root directory with nothing else in it, its own user with no privileges, its own process and resource limits, and only the three devices a virtual machine needs.

The network

• A sandbox has no public IPv4 address for incoming traffic. Visitors reach it through preview links, Cubes’ addresses and your own domains; you reach it through the API, the console and the SSH gateway.
• Outbound connections to port 25 (email) are blocked by default, and egress rules restrict where a sandbox may connect.
• Each project has a private network of its own, on which its services find each other by name.

Keys and access

• An API key belongs to one project and opens only what its scopes allow: reading; making and changing; running commands, files, terminals and links; or administering the project.
• The members of an account are owners, admins or members. Only owners run billing and can close the account.
• An audit log records what is done in a project; keys with the admin scope can read it.

Your data

• We use your content only to provide the service, and we do not sell it. Our staff look at it only when you ask for support, when it is needed to keep the service running or secure or to investigate abuse, or when the law requires it.
• What a project keeps, its disks, the memory of its sleeping sandboxes, its snapshots, volume backups and Cubes’ logs, is sealed with that project’s own key before it leaves the machine. One project’s key opens nothing of another’s.
• Secrets, Cubes’ settings and certificates are sealed with our master key, which is held under AWS Key Management Service and kept on no disk.
• Backups of volumes are kept for 1 to 365 days, as you choose.
• Your card is held by Stripe, our payment processor. We keep only its brand, last four digits, expiry date and issuing country.

The Privacy Policy and the Data Processing Agreement say the rest.

Reporting a weakness

If you find a weakness in Glac, write to security@glac.ai with what you found and how to reproduce it. We welcome security research that keeps to these rules:

• Use only accounts, sandboxes and data that are yours.
• Do not open, change or keep other customers’ data. If you reach any, stop and tell us.
• Do not degrade the service for others: no denial of service, no spam, no tricking our staff or customers.
• Give us 90 days to fix what you found before you make it public, or until it is fixed, if that is sooner.

If you keep to these rules, we will not take legal action against you for your research. We do not pay rewards for reports yet.

If you think someone has used your account without your permission, write to the same address at once.