Security at the Core
RasnuCloud manages your production infrastructure. That requires absolute trust. Here is a transparent breakdown of exactly how we protect your servers, data, and credentials.
Pillar 1: Network Isolation
The fundamental rule of RasnuCloud's architecture is that the agent never listens on a public port. You do not need to punch holes in your firewall or expose an RPC server to the internet.
- Outbound WebSockets: The agent dials out to the RasnuCloud Control Plane via an encrypted WSS connection over Port 443.
- NAT Traversal: Because the connection is outbound, RasnuCloud works natively behind strict NATs, VPCs, and egress-only firewalls.
- Zero Attack Surface: A port scanner hitting your server will see nothing related to RasnuCloud.
Agent
Control Plane
Pillar 2: Authentication & RBAC
Passing around the root `id_rsa` key to your engineering team is a security nightmare. RasnuCloud acts as an identity-aware proxy between your team and your infrastructure.
- Role-Based Access Control: Assign users exactly the permissions they need. Viewers can see logs and metrics; Operators can restart services; only Admins can execute raw commands.
- One-Click Revocation: Offboard an employee in 1 second. You don't need to rotate SSH keys across 50 servers ever again.
- Token Authentication: The agent authenticates to the control plane using high-entropy cryptographic tokens.
Pillar 3: Data Encryption
When RasnuCloud manages your environment variables, database passwords, or custom SSL certificates, it treats them as highly sensitive payload data.
- Encryption at Rest: All secrets are encrypted in the RasnuCloud database using industry-standard AES-256-GCM authenticated encryption.
- In-Memory Decryption: Secrets are only decrypted in memory at the exact moment they are transmitted over TLS to your server's agent.
- Zero Third-Party Tracking: We use absolutely no third-party analytics (like Google Analytics or PostHog) inside the control plane. Your infrastructure topology is strictly your own.
Data Handling & Privacy
We believe your data is a liability, not an asset. We store exactly what is required to manage your fleet, and nothing more.
What we store
- Server metadata (IP, OS, specs)
- Terminal and AI conversation history
- Immutable audit logs
What we NEVER store
- The contents of your files
- Your database contents or backups
- Your users' PII
Responsible Disclosure
We consider the security of our users' infrastructure to be our highest priority. If you are a security researcher and have discovered a vulnerability in RasnuCloud, we want to hear from you.
- We will acknowledge your report within 24 hours.
- We will provide a timeline for triage and resolution.
- Please do not disclose the vulnerability publicly until a fix is released.