Security

Borealis runs code on behalf of users, so scoped access and clear workload boundaries are central to the product design. This page describes the controls currently built into the platform without implying third-party certifications or service-level commitments.

Sandbox Boundaries

• Workloads run in sandboxes with explicit CPU and memory allocations.
• Network, port, environment, and runtime capabilities are configured per sandbox.
• Nested-container access is opt-in and intended only for trusted workloads.
• Sandbox lifecycle operations are mediated by the Borealis control plane.

Identity and Tenant Boundaries

• OpenID Connect and OAuth are used for interactive and programmatic authentication.
• Fine-grained scopes restrict sandbox, snapshot, registry, usage, and host operations.
• Organisation and tenant context is enforced by authenticated API operations.
• Service principals support scoped machine-to-machine access without sharing user passwords.

Host and Capacity Controls

• Borealis-managed and client-owned hosts are separated into explicit host pools.
• Private host enrolment is controlled by plan entitlement and short-lived enrolment credentials.
• Placement honours pool ownership, availability, and configured capacity.
• Host credentials can be revoked when a host is retired.

Data and Transport

• Public web and API traffic is served over HTTPS.
• Secrets and credentials are kept out of public source and configuration examples.
• Workspace exports and snapshots are authorised within their owning organisation.
• Operational and billing records are persisted for service integrity and auditability.

Your Responsibilities

• Use strong authentication and enable multi-factor authentication where available.
• Grant only the scopes and organisation permissions a person or service principal needs.
• Treat nested-container access and private hosts as privileged infrastructure.
• Do not place secrets in images, logs, commands, or environment values unless required and properly protected.
• Keep workload images and dependencies patched.

Responsible Disclosure

If you believe you have found a security vulnerability, please follow our Vulnerability Disclosure Policy. Do not access other users' data or disrupt production services while testing.

Contact