Isolation you can audit, controls you can verify
The infrastructure under your models is audited, isolated and encrypted, and the people running it have no standing access to your data. Here is how it fits together.
Certifications and frameworks
Security, availability and confidentiality. Audited annually; report available under NDA.
Certified information security management system covering all regions and operations.
EU data residency in eu-north-1, standard contractual clauses and a DPA on request.
BAA available for dedicated clusters with the required technical safeguards.
California privacy compliance for personal information we process on your behalf.
Environmental management system for facility operations and hardware lifecycle.
Isolation at every layer
Dedicated hardware
No GPU is ever shared between customers at the same time. Reserved nodes, fabrics and storage are single tenant for the life of your contract.
Encryption everywhere
AES-256 at rest with per-customer keys, TLS 1.3 in transit, and an isolated InfiniBand partition per cluster. Bring your own KMS on dedicated clusters.
Private networking
Isolated VPC per account, security groups, private interconnects, site-to-site VPN and no public IP unless you ask for one.
Physical controls
Mantraps, biometrics, 24/7 staffed security, CCTV with 90-day retention and private cages with customer-managed access lists.
Secure lifecycle
Firmware verified at boot, cryptographic erase between tenants, and certified destruction for drives at end of life.
Monitoring and response
24/7 security operations, anomaly detection on the fleet, tested incident response runbooks and customer notification within 24 hours.
Your identity provider, your rules
- SSO with SAML 2.0 and OIDC, SCIM user provisioning and deprovisioning
- Role-based access control across organizations, projects and resources
- MFA enforcement and session policies configurable per organization
- Scoped API keys with expiry, IP allowlists and rate limits
- Immutable audit logs for every administrative action, exportable to your SIEM
- No standing staff access. Break-glass requires your approval and is reported to you
- ResidencyRegion-pinned, never replicated across borders
- SubprocessorsPublished list, 30-day change notice
- RetentionDeleted 30 days after closure or on request
- Deletion proofCertificate of destruction available
- AgreementsDPA, BAA, SCCs, custom MSA
- Pen testingThird-party, annual, summary shared
Can we get your SOC 2 report and penetration test results?
Yes. Email security@greenaibox.com or ask your account team. We share the full SOC 2 Type II report, ISO certificate and a summary of the latest third-party penetration test under NDA.
How do you isolate customers?
GPU Cloud instances are bare metal or VMs with dedicated GPUs; nodes are never shared between customers at the same time and are wiped between tenants. Clusters and reserved nodes are single tenant for the life of the contract, including their InfiniBand partition and storage.
Where is data stored and who can access it?
Data stays in the region you select. GREENAIBOX staff have no standing access to customer instances or storage. Break-glass access requires customer approval or a documented incident, is time-limited, and is logged and reported to you.
What happens to our data when we leave?
Instance NVMe is cryptographically erased on termination. Persistent storage is deleted within 30 days of account closure or immediately on request, with a certificate of destruction available.
How do you handle vulnerabilities?
We run a coordinated disclosure program. Report issues to security@greenaibox.com. We acknowledge within one business day, and we patch critical issues across the fleet within 72 hours.
Send us your security questionnaire
We answer SIG, CAIQ and custom questionnaires within five business days, and our security team joins your review call.