Docs
Get Started

Security and policy

Kuberns deploys and operates workloads on AWS-backed infrastructure. Backend integrations include IAM, EC2, ECR, SSM, Secrets Manager, CodeBuild, CodeDeploy, CodePipeline, CloudWatch, and SES.

Platform controls verified in source

  • OAuth authentication paths.
  • Role-based service permissions.
  • GitHub webhook HMAC signature verification.
  • IAM-based AWS orchestration.
  • Encrypted storage for payment autopay tokens.
  • Temporary agent infrastructure cleanup.
  • Service health checks and recorded healing events.

These implementation details are not a certification or a guarantee that every workload meets a particular regulatory standard.

Shared responsibility

Kuberns operates supported infrastructure workflows. You remain responsible for:

  • Application code and dependencies.
  • Secrets and external credentials you provide.
  • User access decisions.
  • Data classification, retention, and backups.
  • Secure application configuration.
  • Compliance requirements for your workload.
  • Reviewing destructive resource operations.

Security practices

Apply these before deploying production data.

Source access

  • Grant the GitHub App only the repositories Kuberns needs.
  • Remove access when a repository is no longer deployed.
  • Protect deployed branches with your provider's review controls.

Secrets

  • Store runtime credentials in environment variables, not Git.
  • Use separate values for each environment.
  • Rotate credentials after exposure.
  • Avoid printing secret values in build or service logs.
  • Use unique generated values for template authentication and encryption keys.

Access management

  • Give users the lowest role required.
  • Review Owner, Co-Owner, and Partner access regularly.
  • Remove users who no longer need service access.

Domains

  • Verify DNS targets before deleting old records.
  • Keep the allocated Elastic IP record current for root domains.
  • Wait for SSL activation before sending production traffic.

Data protection

Plan application-level backups and restore tests for stateful services. Resource provisioning and container self-healing are not substitutes for recoverable data backups.

Public policies