Security at Cloudfleet

Cloudfleet encrypts your cluster data, isolates every control plane, and restricts and logs staff access. This page summarizes the controls. For the details, see Security and data protection.

Get started
Infrastructure security

Secure by default

Cloudfleet encrypts all data in transit and at rest. Control plane communication and API traffic are secured with TLS. Kubernetes secrets and the Kubernetes backend data stores are encrypted at rest. Cluster nodes connect through a WireGuard®-based encrypted overlay network, ensuring secure communication across clouds and regions. Cloudfleet enforces this encryption regardless of whether the underlying network provides it. Learn more about our networking architecture, and see Security and data protection for where Cloudfleet stores your data and who can access it.

Network isolation

Every cluster operates in its own isolated network environment. Nodes are connected through encrypted tunnels, and control plane endpoints can be restricted to private networks on Enterprise plans. Network policies allow you to control traffic flow between workloads at the pod level. As a multi-cloud solution, Cloudfleet network policies can serve as a firewall between datacenter and cloud boundaries, giving you consistent security controls across all environments.

Control plane hardening

Every cluster has its own control plane, isolated from other clusters. Control plane components are deployed with least-privilege configurations, regularly patched, and monitored for anomalies. Multi-AZ replication ensures high availability on Pro and Enterprise plans.

Node security

Cloudfleet provisions worker nodes on demand and removes them when they are no longer needed.

Secrets management

Control plane data, including Kubernetes Secrets, is stored encrypted at rest. With Confidential Control Plane on Enterprise clusters, all Kubernetes objects are also encrypted with keys held in your own HSM or cloud KMS. Cloudfleet supports integration with external secret management solutions. Service account tokens use short-lived, bound tokens following Kubernetes best practices.

Operational security

How we operate

Cloudfleet maintains strict internal security practices to protect customer infrastructure. Our operational security model is designed to minimize risk and ensure accountability.

Access controls

All Cloudfleet employee access to production infrastructure requires multi-factor authentication, follows least-privilege principles, and is logged for audit purposes. Access is reviewed regularly and revoked promptly when no longer needed.

Vulnerability management

We continuously scan our infrastructure and application stack for vulnerabilities. We maintain a responsible disclosure program and welcome security reports at [email protected].

Incident response

Cloudfleet maintains a documented incident response process with defined severity levels, escalation paths, and communication procedures. All customers are notified of a personal data breach affecting their data within 24 hours. Customers on Enterprise plans also receive direct incident notifications and post-incident reports.

Monitoring and detection

All infrastructure components are monitored continuously for anomalous behavior, unauthorized access attempts, and performance degradation. Alerts notify on-call engineers.

Supply chain security

Container images used in the Cloudfleet platform are built from verified sources, scanned for vulnerabilities, and signed. We track dependencies and respond quickly to upstream security advisories.

Audit logging

Comprehensive audit logs capture all administrative actions, API calls, and infrastructure changes. Administrative logs are kept in append-only storage. On Enterprise clusters, the Kubernetes audit logs of your clusters are delivered to your own infrastructure.

FAQ

Security FAQ

The control plane of each cluster, including its data store and backups, runs in the control plane region you choose: europe-central-1a in Frankfurt, Germany, or northamerica-central-1a in Iowa, United States. Your nodes, and the workloads and data on them, run on the infrastructure you choose. See Security and data protection for what Cloudfleet stores and where.

Cloudfleet is actively working toward SOC 2 Type II and ISO 27001 certifications. Many of the controls required by these standards are already implemented in our platform and operational processes. Enterprise customers can request detailed security documentation, architecture reviews, and a walkthrough of our security controls. Contact our sales team for more information.

Cloudfleet processes personal data in line with the GDPR. We offer a Data Processing Agreement (DPA) and maintain a list of sub-processors, and all staff with production access are located in Germany. Our privacy policy details how we handle personal data. For more information, see our privacy policy and terms of service.

All data in transit is encrypted with TLS. Node-to-node communication uses WireGuard® encryption. Data at rest, including the Kubernetes backend and Kubernetes secrets, is encrypted. API traffic between your kubectl client and the Kubernetes API server is always encrypted.

Cloudfleet manages the security of the Kubernetes control plane, node provisioning, networking infrastructure, platform patching, and cluster upgrades. Customers are responsible for securing their workloads, container images, application configurations, Kubernetes RBAC policies, network policies for their pods, and any data stored within their applications. This model follows Kubernetes community best practices for managed Kubernetes providers. See Shared responsibility model for details.

If you discover a security vulnerability, please report it to [email protected]. We acknowledge all reports within 48 hours and work with reporters to understand and address the issue. We follow responsible disclosure practices and appreciate the security community’s efforts to keep Cloudfleet safe.

Yes. All plans include Kubernetes RBAC and SSO integration for access control. Enterprise customers can additionally enable control plane private networking, restricting API server access to authorized networks only.

Cloudfleet accesses cluster control plane components for management operations such as upgrades, scaling, and health monitoring. Cloudfleet does not access customer workloads, application data, or Kubernetes secrets unless explicitly authorized by the customer for a limited time window, such as during a support session. All management access is audited and follows least-privilege principles.

Security built-in.

Access control & governance

Fine-grained role-based access control (RBAC) with organization and project scopes, least-privilege permissions, and comprehensive audit trails for all user actions.

User
User
Kubernetes
User
User

Identity federation

Enterprise Single Sign-On (SSO) via SAML and OIDC, integrating with Okta, Microsoft Entra ID, Google Workspace, JumpCloud, and other compatible identity providers.

Cloudfleet Microsoft Entra integration
Cloudfleet Okta integration
Cloudfleet Google Workspaces integration

Enterprise-grade security

Governance, centralized audit logging, and compliance readiness aligned with SOC 2 and ISO 27001 standards (certifications in progress).

Cloudfleet GDPR badge
GDPR
COMPLIANT
Cloudfleet CCPA badge
CCPA
COMPLIANT

Try Cloudfleet with €200 in credit

Create a managed Kubernetes cluster in minutes. Every new account gets €200 in credit, so you can explore the full platform with no charge until it's used or expires.

Get started