Skip to main content

Security

Security is at the core of the Null Autos platform. We implement industry-leading security practices to protect your data and ensure the integrity of your virtual devices.

Compliance & Certifications​

  • SOC 2 Type II: Annual audits for security, availability, and confidentiality
  • GDPR Compliant: Full compliance with EU data protection regulations
  • ISO 27001: Information security management system certification
  • HIPAA: Healthcare data protection standards (available on request)

Data Security​

Encryption​

At Rest​

  • All data encrypted using AES-256
  • Hardware security modules (HSM) for key management
  • Regular key rotation
  • Separate encryption keys per customer

In Transit​

  • TLS 1.3 for all API communications
  • Certificate pinning for mobile and desktop clients
  • Perfect forward secrecy (PFS)
  • HSTS (HTTP Strict Transport Security)

Data Isolation​

  • Network Isolation: Customer workloads in isolated VPCs
  • Storage Isolation: Separate storage volumes per customer
  • Compute Isolation: VM-level isolation for each device
  • Database Isolation: Multi-tenant database with row-level security

Access Control​

Authentication​

  • Multi-Factor Authentication (MFA): Required for all accounts
  • SSO Integration: SAML 2.0 and OpenID Connect support
  • API Keys: Scoped API keys with automatic rotation
  • OAuth 2.0: Token-based authentication for programmatic access

Authorization​

  • Role-Based Access Control (RBAC): Fine-grained permissions
  • Principle of Least Privilege: Minimal required permissions
  • Audit Logging: All access attempts logged
  • Session Management: Automatic session timeout and renewal

Available Roles​

  • Owner: Full administrative access
  • Admin: User management and resource allocation
  • Developer: Device creation and management
  • Viewer: Read-only access to resources
  • API User: Programmatic access only

Infrastructure Security​

Network Security​

  • Firewall Protection: Stateful firewalls on all boundaries
  • DDoS Mitigation: Automated DDoS protection
  • IP Allowlisting: Restrict access by IP range
  • Private Connectivity: VPN and AWS PrivateLink support

Compute Security​

  • Secure Boot: Verified boot chain for all VMs
  • Runtime Protection: Integrity monitoring and intrusion detection
  • Security Patching: Automated patch management
  • Vulnerability Scanning: Regular security scans

Container Security​

  • Image Scanning: All container images scanned for vulnerabilities
  • Signed Images: Cryptographically signed container images
  • Runtime Policies: Enforced security policies at runtime
  • Minimal Base Images: Reduced attack surface

Monitoring & Incident Response​

Security Monitoring​

  • Real-time Alerts: Immediate notification of security events
  • Anomaly Detection: ML-based threat detection
  • Log Analysis: Centralized security information and event management (SIEM)
  • Threat Intelligence: Integration with threat intelligence feeds

Incident Response​

  • 24/7 Security Team: Always-on security operations center (SOC)
  • Incident Response Plan: Documented procedures for security incidents
  • Regular Drills: Quarterly incident response exercises
  • Disclosure Policy: Responsible disclosure process

Data Privacy​

Data Handling​

  • Minimal Collection: Only collect necessary data
  • Data Retention: Configurable retention periods
  • Data Deletion: Secure data deletion on request
  • Data Portability: Export your data at any time

Privacy Controls​

  • Consent Management: Clear consent for data processing
  • Right to Access: Request copy of your data
  • Right to Erasure: Request deletion of your data
  • Data Processing Agreements: Available for enterprise customers

Compliance Controls​

Audit Trails​

  • Complete audit logs for all actions
  • Immutable log storage
  • Log retention for 7 years
  • Available for compliance audits

Regular Assessments​

  • Annual SOC 2 audits
  • Quarterly penetration testing
  • Continuous vulnerability assessments
  • Third-party security reviews

Customer Responsibilities​

Shared Responsibility Model​

Null Autos Responsibilities:

  • Platform security
  • Infrastructure protection
  • Data encryption
  • Compliance certifications

Customer Responsibilities:

  • Account security (strong passwords, MFA)
  • API key management
  • Application security
  • Data classification

Best Practices​

  1. Enable MFA on all accounts
  2. Rotate API keys regularly (every 90 days)
  3. Use least privilege access principles
  4. Monitor access logs for suspicious activity
  5. Report security concerns immediately

Security Reporting​

Vulnerability Disclosure​

If you discover a security vulnerability, please report it to:

  • Email: security@null.autos
  • PGP Key: Available on our website
  • Response Time: Within 24 hours
  • Bug Bounty: Available for qualifying reports

Security Updates​

  • Security Advisories: Published on our status page
  • Notification: Email alerts for critical issues
  • Changelog: Documented in release notes

Additional Resources​

Questions?​

For security-related questions, contact our security team: