Security at IncubaCloud

Isolation by design

Every customer gets their own panel, with its own containers and its own database. No two customers share an Odoo process or a database.

Hardened servers

Servers we provision for you are hardened automatically, and a VPS you connect gets the same hardening with one click, offered the first time you trust it:

• a dedicated operator user and SSH limited to the platform and the addresses you allow, enforced both by the server's firewall and, on servers we provision, by Hetzner's firewall in front of it;
• automatic security updates;
• kernel and Docker daemon hardening;
• audit rules;
• blocking of repeated failed logins.

Protected logins

Login pages get a dedicated request limit in front of Odoo. Panel accounts can use two-factor authentication, and access to the platform goes through single sign-on.

The platform behind Cloudflare

Visitors reach the panels we host through Cloudflare, which filters their traffic before it gets to our servers.

Encrypted backups, kept in the EU

Backups are encrypted before they leave your server. Paid plans keep the panel's own backups in the EU, and you can contract managed storage on Cloudflare R2 or use a bucket of your own on any S3-compatible service. Plans with continuous recovery can take production back to any minute of their backup window.

Your secrets stay secret

Passwords, keys and tokens are encrypted at rest. Each instance's encryption key is kept by the platform, so an instance that moves to another server can still read its own secrets.

Safe copies

A staging or development copy of your production is neutralized before anything runs on it: no outgoing mail, no scheduled jobs, no integrations. Its access to the internet is limited to the domains you allow.

Visibility

Every action on your servers and instances, by you, your team or IncubaCloud's operators, is recorded in an audit trail.