Security Overview
Security documentation and threat models for tasmanian.cloud — covering VPS, Kubernetes, RustFS, Netbird, and core platform controls.
This section provides comprehensive security documentation for tasmanian.cloud, including threat models, security controls, and compliance information.
Security Principles
Our security approach is built on these core principles:
- Defense in Depth — Multiple layers of security controls
- Zero Trust — Never trust, always verify
- Least Privilege — Minimum necessary access
- Sovereignty by Design — Data stays in Tasmania
- Transparency — Open documentation of our security model
Service Threat Models
Each service has a detailed threat model following the OpenBao security model format:
VPS
Virtual machine isolation, hypervisor security, and network segmentation
Templates
Container security, supply chain integrity, and automatic updates
Kubernetes
Cluster isolation, pod security, RBAC, and runtime protection
RustFS Storage
Post-quantum encryption, access control, and data integrity
Netbird VPN
Mesh VPN security, peer authentication, and network access control
Security Goals by Service
| Service | Confidentiality | Integrity | Availability | Sovereignty |
|---|---|---|---|---|
| VPS | VM isolation | Snapshot integrity | High availability design | 100% Tasmanian |
| Templates | Container isolation | Image verification | High availability design | 100% Tasmanian |
| Kubernetes | Pod isolation | GitOps verification | High availability design | 100% Tasmanian |
| RustFS | PQ encryption | Checksum verification | Durability by design | 100% Tasmanian |
| Netbird | WireGuard encryption | Peer authentication | Mesh redundancy | 100% Tasmanian |
Common Security Controls
Encryption
| Layer | Algorithm | Implementation |
|---|---|---|
| Data in transit | TLS 1.3 | All external and internal APIs |
| Data at rest | AES-256-GCM | Database and storage encryption |
| Post-quantum | Kyber-768 + Dilithium-3 | RustFS object encryption |
| VPN | ChaCha20-Poly1305 | WireGuard mesh |
Authentication
- Multi-factor authentication — Required for all administrative access
- API keys — HMAC-SHA256 signed requests with rotation
- JWT tokens — Short-lived access tokens (15 min) with refresh
- Hardware keys — WebAuthn/FIDO2 supported
Network Security
- Default deny — All traffic denied unless explicitly allowed
- Micro-segmentation — VLANs and network policies isolate workloads
- VPN-only access — No public IPs for customer resources
- DDoS protection — Cloudflare Magic Transit
Monitoring and Response
- Wazuh SIEM — Real-time log aggregation and correlation
- Tetragon — eBPF-based runtime threat detection
- Falco — Container runtime security
- 24/7 alerting — PagerDuty integration for critical alerts
Standards Alignment
We design our controls to align with the standards below. We are not certified against ISO 27001 or SOC 2.
| Standard | Alignment | Scope |
|---|---|---|
| ISO 27001 | Aligned (not certified) | All services |
| Essential 8 | Aligned | Australian government baseline |
| PCI DSS | SAQ A scope | Payment processing |
Data Sovereignty
- 100% Tasmanian — All data stored in Launceston, Tasmania
- No offshore transfers — Data never leaves Australia
- Australian jurisdiction — Subject to Australian law
- Privacy Act alignment — Australian Privacy Principles
Vulnerability Disclosure
We welcome responsible security research.
- Contact: security@tasmanian.cloud
- PGP Key: available on request — email security@tasmanian.cloud
- Response target: Prompt acknowledgment during business operations
- Bounty program: Coming soon
Scope
- *.tasmanian.cloud
- API endpoints
- Customer-facing infrastructure
Out of Scope
- Social engineering attacks
- Physical attacks on facilities
- Third-party services (Stripe, Cloudflare, etc.)
- Customer applications or data
Security Updates
Subscribe to security advisories:
- Email: security-alerts@tasmanian.cloud
- Status page: https://status.tasmanian.cloud