Account and billing
Security
What Cloud stores and shows back, how sessions and support sessions work, and handling your secrets.
Updated
What Cloud keeps about you and your services, what it shows back and to whom, how sessions and support access work, and what you should do with your own secrets.
Signing in
Cloud never sees a password. You sign in with GitHub or Google through your Cahaves account, and Cloud receives your name, email address, picture and sign-in methods once the provider has confirmed who you are. Sign in and your Cahaves account covers the steps.
Sessions
A sign-in gives your browser a session cookie that lasts 30 days from the moment you signed in. Scripts on a page cannot read it, and outside local development it is sent only over HTTPS.
Cloud keeps a one-way hash of the session, never the session itself, so its own records cannot be used to sign in as you.
Sign out ends the session at once, on Cloud's side as well as in your browser.
Cloud's API accepts only that session. There are no API keys or personal tokens to leak. Authentication has the details.
If Cahaves closes an account, its sessions stop working on the next request and it cannot sign in again.
What is yours alone
Everything you create belongs to you, in the organization you created it in. Another customer's projects, services, logs and backups are not visible to you, and yours are not visible to them: asking for one by its id answers as if it did not exist. The console and the API show one of your organizations at a time, and a project of another of yours answers the same way until you switch to it. A backup download goes through Cloud with your session, which checks the backup belongs to the organization the console is in.
Secrets Cloud keeps
| What | How it is kept | Where you see it again |
|---|---|---|
| Environment variables | Encrypted | On the service's Environment section, hidden until you press Edit |
| Database passwords | Encrypted | On the database's Connection card, hidden until you choose to show it |
| Notification channel details: webhook URL, signing secret, bot token, chat ID, email address | Encrypted | Never. Editing the channel offers Keep saved configuration or Replace configuration. |
| GitHub access | Cloud keeps the installation's number and account name, not a token. It asks GitHub for a short-lived token when it reads a repository. | Not applicable |
| SSH keys | The public key and its fingerprint only. Cloud refuses a private key pasted by mistake. | On SSH keys, by name and fingerprint |
A database password is generated in your browser when you create the database, unless you set your own. Databases covers changing it.
Reaching a database
A database has no domain. Your services connect to it on its Internal address, and the form that creates it says services in its project reach it on its port. Do not rely on the network to keep a database private: its password is what protects it. Keep the password out of your repository, and change it with Set the password if it leaks.
Public access opens the database on a port from 20000 to 29999 of the node it runs on, where anyone who can reach that address can try to connect. Turn it on only while you need it, and turn it off with Turn off afterwards.
Support sessions
A Cahaves operator can act on your services only through a support session. It is opened on your account with a reason and a ticket, reaches the services of every organization you own, lasts at most four hours, and ends earlier if the operator's own staff sign-in ends.
While a session is open, every screen shows the operator's name followed by "is assisting with your workspace", with the reason, the ticket and when it expires. Support lists every open session.
During it, the operator can see your services and their recent deployments, and can deploy, stop and start them.
The operator cannot see your environment variables, your compose files or your database passwords, and cannot change a service's settings through the session.
Cahaves records every request made through a session in its audit log, with the operator and the ticket.
Support covers how to ask for help.
What Cahaves can do to an account
Cahaves can suspend an account or close it, never one organization alone. A suspension by Cahaves shows on Billing, stops the services of all your organizations and refuses changes in them until Cahaves lifts it: contact Support. Stored data is kept.
What to do with your own secrets
Put secrets in a service's environment, not in your repository or your image. The environment is encrypted, shown only to you, and hidden from an operator during a support session.
Never paste a secret into a support ticket or an email. An operator does not need one to deploy, stop or start a service.
Give each database its own password, and change it if anyone who should not have it may have seen it. Then update the services that use it, since the old one stops working.
Remove SSH keys you no longer use. SSH keys shows when each was last used. A shell already open with a removed key stays open until it ends.
Disconnect GitHub accounts you no longer deploy from under Git providers, and remove the Cahaves GitHub App on GitHub itself: disconnecting in Cloud leaves the App installed there.
Give every webhook channel a signing secret, and check the signature header on each delivery before trusting it. Notifications describes the header.
Keep a database's Public access off unless something outside Cloud needs to reach it.