Security Policy

Last updated Nov 4, 2026 · Version 1

Security is at the core of pfcloud, because it holds the keys to your servers. This page describes how we protect them and how to report a problem.

Access to your servers

• Each team has its own SSH key. Private keys are encrypted at rest and never shown or exported.
• Every server's host key is pinned on first connection, so we refuse to talk to an impostor.
• Scripts run over SSH with settings passed as environment variables, never on the command line.
• Passwords you type to install a key are used once and never stored, queued or logged.
• Servers that already run live sites are adopted read-only: we don't change their shared services without your action.

Your account

• Passwords are stored as strong one-way hashes.
• Two-factor authentication (authenticator apps and passkeys) is available to everyone and required for staff and for teams that manage many servers.
• Team owners control members' permissions and which servers and sites each member can reach.
• Optional single sign-on through your identity provider.
• Destructive actions such as deleting a server or site need confirmation, your password and an emailed code.

Your data

• Backups are encrypted with a unique key per backup and checked with SHA-256 checksums.
• Environment files and logs are read live from your server and not stored by us.
• Every change in your team is recorded in a tamper-evident audit log, chained with SHA-256 and verified nightly.
• Teams are isolated from one another, and we test that isolation automatically.

Our platform

• All traffic uses HTTPS; security headers are set on every page.
• Staff access to customer areas is limited by role, requires two-factor authentication and is logged.
• Dependencies are pinned and reviewed before updates.
• We monitor our own servers for attacks, failed sign-ins and resource problems.

Reporting a vulnerability

If you believe you've found a security issue, email myforge@steadyridedrivingschool.com with the details and steps to reproduce. Please:

• give us reasonable time to fix it before telling anyone else;
• don't access, change or delete other people's data, and stop as soon as you find a problem;
• don't run tests that could degrade the Service for others (no denial-of-service).

We will acknowledge your report within 3 working days, keep you updated, and credit you if you wish. We will not take legal action against good-faith research that follows these rules.