# Trust & security > Trust & security at OverGPU: whole GPUs with no co-tenancy, root access by SSH key or password, secure disk erasure, DDoS mitigation and proportionate checks. Read how. Source: https://overgpu.com/trust Updated: 2026-10-23 Publisher: OverGPU (https://overgpu.com/) ## Key points - **No co-tenancy on your GPU:** Whole GPUs only: bare-metal 8-GPU servers, or a dedicated VM with the full GPU passed through. - **You hold root:** You log in with your SSH key or your own password, and we do not access your data except to operate or repair the service at your request, or when the law requires it. - **Secure erasure:** Disks are securely erased between customers, so your data never meets the next tenant. - **DDoS mitigation:** Mitigation on every public IP address, plus firewall guidance for your own rules. - **No card details, no wallet keys:** Top-ups are paid in crypto to one-time deposit addresses. We never ask for seed phrases or private keys. - **No trackers:** Our website uses no advertising or analytics trackers, and we never sell personal data. ## Overview This page sets out our approach to trust & security for the GPU servers we rent: how your workloads are isolated, who can reach your server and your data, how the network and payments are protected, and how we keep the service lawful. Good GPU cloud security starts with the hardware model, so we begin there. Where something is your responsibility rather than ours, we say so. ## GPU cloud security starts with isolation Every GPU we rent is a whole physical GPU assigned to one customer. We do not use vGPU slicing, MIG partitions or time-sharing, so there is no co-tenancy on your GPU: no other customer's process runs on it, shares its memory or competes for its compute. - **8-GPU servers are bare metal.** The entire machine is yours, with no hypervisor between your operating system and the hardware. - **Single-GPU plans are a dedicated VM** with the full GPU passed through, so the GPU and all of its memory are attached to your VM alone. If your security model requires the whole host, CPUs included, to be yours alone, choose an 8-GPU bare-metal server. Our article on [dedicated vs shared GPUs](https://overgpu.com/blog/dedicated-vs-shared-gpus) explains the trade-offs of sharing a GPU. ## Access and your data You receive root access over SSH, authenticated by the key you add when you deploy the server. You decide which keys can log in, which users exist and what software runs. Keep your keys secure: you are responsible for activity on your servers. The same applies to your OverGPU account, which holds your servers, balance and invoices: keep its password secure, and we recommend turning on two-factor authentication. See our [SSH access guide](https://overgpu.com/docs/ssh-access) for key setup. You keep all rights to the data you store. We do not access it except when necessary to operate or repair the service at your request, or when required by law. Two more points are worth stating plainly: - **Backups are your responsibility.** Local NVMe storage is not backed up by us unless agreed in writing. Copy datasets, checkpoints and model weights you cannot recreate to storage you control. - **Disks are securely erased between customers.** After you cancel, your server runs until the end of the paid month, then it is decommissioned and its disks are securely erased. For personal data about you, such as account, billing and support records, our [privacy policy](https://overgpu.com/legal/privacy) explains what we collect and why. Our website uses no advertising or analytics trackers, we never sell personal data, and for rate limits we store only a salted hash of your IP address. ## Network security and firewall guidance DDoS mitigation covers every public IP address. It protects your server's connectivity, but it does not decide which ports are reachable. Each server has a public IPv4 address and an IPv6 /64, so a firewall is part of your setup: - Deny inbound traffic by default and open only what you need, starting with SSH. - Apply the same rules to IPv6 as to IPv4, because your server is reachable over both. - Keep notebooks, TensorBoard and model endpoints off public ports. Reach them through an SSH tunnel, or put authentication in front of them. - Check container port publishing. Docker writes its own firewall rules, so a published container port can be reachable even when your host firewall appears to block it. See our [networking and firewall guide](https://overgpu.com/docs/networking-firewall) for more. Private networking between your servers is available on request, so internal traffic does not need to cross public interfaces. ## Payment security You pay from a prepaid balance in your OverGPU account, which you top up in crypto: Bitcoin (BTC), Ethereum (ETH), Monero (XMR), Tether USDT on TRON (TRC-20) or Solana (SOL). No card details are needed, and card payments are not available yet. Each top-up has its own one-time deposit address and an exact amount, calculated at an exchange rate locked for a limited time, and you send it from your own wallet or exchange account. We never ask for your wallet's seed phrase or private keys. Top-ups are processed through our payment infrastructure and third-party exchange and payment providers. The first month of a server is taken from your balance only when you pay for it in the order form, or, if your balance was short, automatically as soon as your top-up is credited; renewals then follow automatically, with email reminders. Every top-up gets a receipt, and every server payment and renewal an invoice, in your dashboard. Deposit addresses are shown in your dashboard when you start a top-up: if someone sends you a deposit address or a payment request anywhere else, do not pay it; if you have an active server, you can check with us first through a support ticket. Refunds go to a wallet address you control. Unused paid credit is refundable from the Billing page of your dashboard at its US dollar value, in USDT (TRC-20) or the coin you used, and bonus credit is not refundable. Our [crypto payments page](https://overgpu.com/pay-with-crypto) covers coins, networks, fees and the top-up bonus. ## Compliance and acceptable use GPU capacity is subject to export control and sanctions rules, and our servers must not be used for attacks, malware, illegal content or other abuse. Our [acceptable use policy](https://overgpu.com/legal/acceptable-use) lists what is not allowed. We screen for sanctions risk and investigate reports of abuse. Verification stays proportionate. Most orders need only an account and a funded balance. We may ask for more for large orders, signals of fraud, a possible sanctions match, or when the law or a payment provider requires it. When we ask, we tell you exactly what we need and why, and the information is used only for that purpose. ## Report a trust & security issue If you find a vulnerability in our website or service, or see abuse coming from an IP address on our network, report it. Customers open a ticket from their dashboard, with the "Abuse report" topic for abuse. The only route outside the dashboard is for network abuse reported by third parties: the abuse contact published in the WHOIS record of the IP address. Include as much detail as you can: the affected IP address or URL, the time, and steps to reproduce or evidence of the abuse. Please test only against servers you rent, do not access other people's data, and give us a reasonable chance to fix an issue before you disclose it publicly. ## Frequently asked questions ### Can other customers use my GPU? No. Each GPU is assigned to one customer only, with no vGPU slicing, MIG partitions or time-sharing. 8-GPU servers are bare metal, and single-GPU plans are a dedicated VM with the full GPU passed through. ### Can OverGPU staff access my data? We do not access your data except when necessary to operate or repair the service at your request, or when required by law. You keep all rights to the data you store. ### Do you back up my server? No. Local storage is not backed up by us unless agreed in writing, so keep your own copies of anything you cannot recreate. ### What happens to my data when I cancel? Your server keeps running until the end of the paid month. It is then decommissioned and its disks are securely erased. ### Does overgpu.com use tracking cookies? No. We use no advertising or analytics cookies or trackers. Our content delivery and security provider may set strictly necessary cookies that protect the site against abuse. ### How do I report a vulnerability or abuse? Customers open a ticket from their dashboard, choosing the Abuse report topic for abuse; anyone else can report abuse to the abuse contact published in the WHOIS record of the IP address. Include the affected IP address or URL, the time, and steps to reproduce or evidence of the abuse. ## Related pages - [Privacy policy](https://overgpu.com/legal/privacy): What we collect, why, and your rights. - [Acceptable use policy](https://overgpu.com/legal/acceptable-use): What you can and cannot run on our servers. - [Verification policy](https://overgpu.com/legal/verification): When we may ask for verification, and why. - [What happens to my data after cancellation?](https://overgpu.com/help/data-deletion): Your GPU server runs until the paid month ends, then its disks are securely erased. Back up first: here is how. - [GPU server infrastructure](https://overgpu.com/infrastructure): HGX B300 to H100, AMD MI355X and RTX PRO 6000 servers in professional data centers, monitored 24/7. See the specs. - [SSH into a GPU server](https://overgpu.com/docs/ssh-access): Create an ed25519 key on macOS, Linux or Windows, connect, add teammates and disable password login. Copy-ready steps.