Security

Security is foundational to how we build and operate Carolina Cloud. This page describes the measures we take to protect customer workloads, data, and credentials.

Infrastructure & compliance

Our physical infrastructure is hosted in a SOC 2 and HIPAA compliant data center. Carolina Cloud itself is HIPAA compliant. A detailed security document is available upon request — contact hello@carolinacloud.io.

Network isolation

Every customer instance runs on its own VLAN. Firewall rules at the router level enforce strict inter-VLAN isolation — your instance cannot communicate with any other customer’s instance, even if they share the same physical host. Only the host management plane (used for provisioning and health checks) can reach across VLAN boundaries.

VMs

Virtual machines are provisioned with only port 22 (SSH) open by default. You can open additional ports as needed from the dashboard or API — but nothing is exposed until you explicitly allow it.

Containers & web apps

Web application containers (Marimo, RStudio Server) are accessible exclusively through their HTTPS subdomain. There is no SSH port exposed to the internet, eliminating brute-force SSH attack surface entirely. A terminal is available through the web UI for command-line access.

All web app instances require Carolina Cloud authentication — you must be logged in to your account to access any instance URL. This prevents unauthorized access even if an instance URL is discovered or shared. The authentication check happens at the platform level, before the request ever reaches your application.

Kernel-level monitoring

Because containers share the host kernel, we run Falco for real-time kernel-level threat detection across all container hosts. Falco monitors system calls for signs of container escapes, privilege escalation, and other exploit attempts. Our rule sets are continuously updated but not publicly disclosed.

Storage security

Customer object storage is hosted on Wasabi, which maintains SOC 2 Type II, ISO 27001, and HIPAA certifications. Storage credentials are scoped per-customer — each user gets their own IAM identity with access limited to their single bucket.

Credential handling

• API keys are hashed with SHA-256 before storage. We store only the hash and the first four characters for display. The plaintext key is shown exactly once at creation time and never persisted.
• Login and signup forms are protected by Cloudflare Turnstile (CAPTCHA) to prevent automated credential attacks.
• OAuth sign-in via Google and GitHub is supported, so you can avoid password-based authentication entirely.
• CSRF protection is enabled on all state-changing endpoints.

Requesting our security document

If you need a formal security assessment for compliance or procurement purposes, we’re happy to provide our full security document. Email hello@carolinacloud.io.