Security
How we isolate customer environments, protect data, control access and respond to incidents. The compliance section describes where we are today, including what we don't hold yet.
Isolation
- Compute
- KVM-based microVMs, one per customer environment. Customers do not share a kernel or container runtime.
- Network
- Each environment has its own private network. Databases accept connections only from that network unless you add an allow list.
- Storage
- Volumes are allocated per environment and securely erased when released.
Encryption
- At rest
- AES-256 on all volumes and backups.
- In transit
- TLS 1.2 and 1.3 at the edge. Database connections require TLS.
- Secrets
- Environment variables are encrypted at rest, scoped per environment, and visible only to roles with permission.
Access
- Your team
- Role-based access, two-factor authentication, SSO on Custom plans, and an audit log of deploys, configuration changes and access grants.
- 9live staff
- No standing access to customer environments. Access is granted for a specific support ticket or migration, logged, and visible to you.
- Production systems
- Staff access to production infrastructure requires hardware security keys and is reviewed quarterly.
Vulnerability management
- Patching
- Host kernels and platform components are patched on a rolling schedule. Critical vulnerabilities are patched within 72 hours of a fix being available.
- Managed databases
- Minor versions and security fixes are applied in your maintenance window.
- Dependencies
- Platform dependencies are scanned continuously and updated as part of regular releases.
Incident response
- Monitoring
- Hosts, network and platform services are monitored continuously, with an engineer on call at all times.
- Communication
- Incidents affecting customers are posted on the status page within 15 minutes of detection.
- Post-incident reports
- A written report within five working days of any incident that affected customers.
- Data breaches
- If your data is affected, we notify you within 72 hours, in line with our DPA and the DPDP Act.
Compliance status
9live is in early access and does not yet hold SOC 2 or ISO 27001 certification. Our data centre operator holds ISO 27001 and ISO 9001. We are building our controls against SOC 2 Type II and plan an independent audit after general availability.
Our Data Processing Agreement and sub-processor list are published, and we complete vendor security questionnaires for Custom plan customers. We will update this page when certifications are issued.
Reporting a vulnerability
Email support@9live.in with a description and steps to reproduce. We acknowledge reports within two working days and keep you updated until the issue is resolved.
We won't take legal action against researchers acting in good faith who avoid harming customers or their data.
Security review
Send us your questionnaire or arrange a call with your security team.