Platform · Vault Security

Security that is
default, not a tier.

Isolated containers, encrypted credentials, signed updates and automated snapshots. The vault is how the network keeps your business running when everything else breaks.

Email, password, notifications and the Privacy & data controls on your profile.Issue 04 · Vault
Account settingsEmail, password, notifications and the Privacy & data controls on your profile.
Package signingEd25519plugin updates are refused without a valid signature
Login rate limit10/minper IP, with burst protection on the hub
Isolation1 namespaceper web app, with its own disks and bucket
Secrets at restlibsodiumsocial and gateway tokens encrypted, keys outside the web root
Unauthenticated REST401the hub API answers nothing without credentials
Daily snapshotsIncludedwith quota-aware retention and explicit prune reports
A per-user runtime that only sees the sites your memberships grant.Look 05 · Boundaries
Web ShellA per-user runtime that only sees the sites your memberships grant.
Zero trust by construction

Every boundary is a real boundary

A hosted web app is its own namespace. A member’s browser terminal is its own pod, with its own workspace volume, and it can only reach its own namespace. The hub’s REST API refuses anonymous requests, XML-RPC is off, PHP cannot execute from uploads and source-control folders are unreachable from the web.

Compute-gas usage and dispatch endpoints require network-administrator rights; devices authenticate with device tokens, never with a browser session. Logins are rate-limited per client IP.

  • Per-app namespaces with dedicated volumes
  • Per-user web-shell runtimes, reaped after 5 idle minutes
  • Hub REST defaults to 401; admin-only compute endpoints
  • XML-RPC disabled, uploads cannot run code, .git blocked
The vault

Seven controls you get on day one

Encrypted tokens

Connected social accounts and gateway credentials are stored in an authenticated libsodium envelope, keyed from a file outside the web root.

Signed updates

GenD Society plugin releases ship with a SHA-256 digest and an Ed25519 signature. Your site verifies both before installing anything.

Plugin feed →

Signed sessions

Single sign-on between gend.me and your apps uses HS256-signed tokens bound to your user id. Unsigned tokens are rejected outright.

Snapshots and rollback

Daily backups with optional twice-daily or hourly frequency, retained within your quota and listed with their prune history.

Sovereign storage →

Consent-gated tracking

A bilingual consent banner sets Consent Mode defaults before any tag. Marketing pixels and server cookies only run with your yes.

Privacy policy →

Private by policy

Buckets are private; organisation policy forbids public access. Even the update server reads its bucket through workload identity, not public links.

Secrets in the cluster

Payment-gateway seeds and WordPress salts live in cluster secrets, not in config files on disk.

Your checklist

Four things to do after you register

Verify your email

A one-time code confirms your account. Verified members skip captchas across the network.

Set privacy & data

On your profile: keep AI on gend.me compute only, opt out of the shared Brain, and manage consent.

Size your backups

Choose a storage tier and frequency that match how fast your data changes.

Keep plugins current

Signed updates install from the gend.me feed. Connected sites get a reconnect notice if a token ever expires.

The safest credential is the one that was never shared. The network is built on keys that prove, not passwords that trust.
GenD Compute Network · Security principles
Sleep easy

Run your business on a vault.

Register, launch and let the defaults protect you.