Trust & security

This page sets out our approach to trust & security for the GPU servers we rent: how your workloads are isolated, who can reach your server and your data, how the network and payments are protected, and how we keep the service lawful. Good GPU cloud security starts with the hardware model, so we begin there. Where something is your responsibility rather than ours, we say so.

GPU cloud security starts with isolation

Every GPU we rent is a whole physical GPU assigned to one customer. We do not use vGPU slicing, MIG partitions or time-sharing, so there is no co-tenancy on your GPU: no other customer's process runs on it, shares its memory or competes for its compute.

• 8-GPU servers are bare metal. The entire machine is yours, with no hypervisor between your operating system and the hardware.
• Single-GPU plans are a dedicated VM with the full GPU passed through, so the GPU and all of its memory are attached to your VM alone.

If your security model requires the whole host, CPUs included, to be yours alone, choose an 8-GPU bare-metal server. Our article on dedicated vs shared GPUs explains the trade-offs of sharing a GPU.

Access and your data

You receive root access over SSH, authenticated by the key you add when you deploy the server. You decide which keys can log in, which users exist and what software runs. Keep your keys secure: you are responsible for activity on your servers. The same applies to your OverGPU account, which holds your servers, balance and invoices: keep its password secure, and we recommend turning on two-factor authentication. See our SSH access guide for key setup.

You keep all rights to the data you store. We do not access it except when necessary to operate or repair the service at your request, or when required by law. Two more points are worth stating plainly:

• Backups are your responsibility. Local NVMe storage is not backed up by us unless agreed in writing. Copy datasets, checkpoints and model weights you cannot recreate to storage you control.
• Disks are securely erased between customers. After you cancel, your server runs until the end of the paid month, then it is decommissioned and its disks are securely erased.

For personal data about you, such as account, billing and support records, our privacy policy explains what we collect and why. Our website uses no advertising or analytics trackers, we never sell personal data, and for rate limits we store only a salted hash of your IP address.

Network security and firewall guidance

DDoS mitigation covers every public IP address. It protects your server's connectivity, but it does not decide which ports are reachable. Each server has a public IPv4 address and an IPv6 /64, so a firewall is part of your setup:

• Deny inbound traffic by default and open only what you need, starting with SSH.
• Apply the same rules to IPv6 as to IPv4, because your server is reachable over both.
• Keep notebooks, TensorBoard and model endpoints off public ports. Reach them through an SSH tunnel, or put authentication in front of them.
• Check container port publishing. Docker writes its own firewall rules, so a published container port can be reachable even when your host firewall appears to block it.

See our networking and firewall guide for more. Private networking between your servers is available on request, so internal traffic does not need to cross public interfaces.

Payment security

You pay from a prepaid balance in your OverGPU account, which you top up in crypto: Bitcoin (BTC), Ethereum (ETH), Monero (XMR), Tether USDT on TRON (TRC-20) or Solana (SOL). No card details are needed, and card payments are not available yet. Each top-up has its own one-time deposit address and an exact amount, calculated at an exchange rate locked for a limited time, and you send it from your own wallet or exchange account. We never ask for your wallet's seed phrase or private keys. Top-ups are processed through our payment infrastructure and third-party exchange and payment providers.

The first month of a server is taken from your balance only when you pay for it in the order form, or, if your balance was short, automatically as soon as your top-up is credited; renewals then follow automatically, with email reminders. Every top-up gets a receipt, and every server payment and renewal an invoice, in your dashboard. Deposit addresses are shown in your dashboard when you start a top-up: if someone sends you a deposit address or a payment request anywhere else, do not pay it; if you have an active server, you can check with us first through a support ticket.

Refunds go to a wallet address you control. Unused paid credit is refundable from the Billing page of your dashboard at its US dollar value, in USDT (TRC-20) or the coin you used, and bonus credit is not refundable. Our crypto payments page covers coins, networks, fees and the top-up bonus.

Compliance and acceptable use

GPU capacity is subject to export control and sanctions rules, and our servers must not be used for attacks, malware, illegal content or other abuse. Our acceptable use policy lists what is not allowed. We screen for sanctions risk and investigate reports of abuse.

Verification stays proportionate. Most orders need only an account and a funded balance. We may ask for more for large orders, signals of fraud, a possible sanctions match, or when the law or a payment provider requires it. When we ask, we tell you exactly what we need and why, and the information is used only for that purpose.

Report a trust & security issue

If you find a vulnerability in our website or service, or see abuse coming from an IP address on our network, report it. Customers open a ticket from their dashboard, with the "Abuse report" topic for abuse. The only route outside the dashboard is for network abuse reported by third parties: the abuse contact published in the WHOIS record of the IP address. Include as much detail as you can: the affected IP address or URL, the time, and steps to reproduce or evidence of the abuse. Please test only against servers you rent, do not access other people's data, and give us a reasonable chance to fix an issue before you disclose it publicly.