Tasmanian Cloud documentation

Security Overview

Security documentation for tasmanian.cloud services

This section describes security controls and encryption choices for tasmanian.cloud. It does not make a certification claim.

Security Principles

Our security approach is built on these core principles:

  1. Defense in Depth - Multiple layers of security controls
  2. Zero Trust - Never trust, always verify
  3. Least Privilege - Minimum necessary access
  4. Sovereignty by Design - Data stays in Tasmania
  5. Transparency - Open documentation of our security model

Encryption

Encryption Standards

LayerAlgorithmImplementation
Data in transitTLS 1.3All external and internal APIs
Data at restAES-256-GCMDatabase and storage encryption
Post-quantumKyber-768 + Dilithium-3Object storage encryption
VPNChaCha20-Poly1305WireGuard mesh

Authentication

  • Multi-factor authentication - Required for all administrative access
  • API keys - HMAC-SHA256 signed requests with rotation
  • JWT tokens - Short-lived access tokens (15 min) with refresh
  • Hardware keys - WebAuthn/FIDO2 supported

Network Security

  • Default deny - All traffic denied unless explicitly allowed
  • Micro-segmentation - Network policies isolate workloads
  • VPN-only access - No public IPs for customer resources
  • DDoS protection - Cloudflare Magic Transit

Monitoring and Response

  • Security logging - Log aggregation and alerting as the platform develops
  • Runtime protection - eBPF-based threat detection
  • Container security - Runtime monitoring for all containers
  • Automated alerting - Critical alerts escalated immediately

Assurance status

Certifications

StandardStatusScope
ISO 27001Not certifiedNo certification claim
SOC 2 Type IINot certifiedNo certification claim
Essential 8Not certifiedNo alignment claim
PCI DSSNot applicable to hostingPayment provider scope is separate

Data Sovereignty

  • 100% Tasmanian - All data stored in Launceston, Tasmania
  • No offshore transfers - Data never leaves Australia
  • Australian jurisdiction - Subject to Australian law
  • Australian jurisdiction - Subject to Australian law

Vulnerability Disclosure

We welcome responsible security research.

  • Contact: security@tasmanian.cloud
  • PGP Key: Download
  • Acknowledgment: We review reports as soon as practical

Note: We do not offer financial rewards for vulnerability reports.

Scope

  • \*.tasmanian.cloud
  • API endpoints
  • Customer Portal
  • Customer-facing infrastructure

Out of Scope

  • Social engineering attacks
  • Physical attacks on facilities
  • Third-party services (Stripe, Cloudflare, etc.)
  • Customer applications or data

Security Updates

Subscribe to security advisories:

  • RSS: https://tasmanian.cloud/security/rss.xml
  • Email: security-alerts@tasmanian.cloud
  • Status page: https://status.tasmanian.cloud

Related Documentation