Security

How secrets are stored

Equific has to hold real credentials — an SSH key that cannot open your server is no use to anybody. What it does with them:

• Every account has its own randomly generated data key.
• Server passwords, SSH private keys, database passwords, environment files, certificate private keys, backup storage credentials and alert webhook URLs are all encrypted with that key.
• The data key is itself encrypted with the application key before being stored, so the database alone yields nothing.
• Keys can be rotated per account without touching anyone else's.

Webhook URLs are treated as secrets rather than addresses, because anyone holding one can post into your Slack or Discord.

The limit, stated plainly

An attacker with both our database and our application key can decrypt your credentials. So can we.

Per-account keys buy blast radius and rotation, not secrecy from the operator. A system that logs into your servers on your behalf must be able to read the credentials that let it in — that is arithmetic, not a design choice, and any product in this category claiming otherwise is describing something it cannot do.

We would rather you knew that before you connected a server than after.

How we reach your servers

• Over SSH, outbound from us to you. There is no agent to install and nothing listening on your server for us.
• Day-to-day work runs as a dedicated managerial account with a specific sudo grant, not as root.
• When a connection fails, each attempt uses one credential at a time so the failure has one clear reason. Failures never log the secret that was tried.
• Provisioned servers get ufw, fail2ban and unattended security upgrades, and SSH is moved off port 22.

Taking over a running server

Adopting a machine somebody else built is the point at which most damage could be done, so it is deliberately cautious:

• The first pass is read-only. It audits and reports, and changes nothing.
• Handing the box over creates the managerial account, installs the key, then opens a brand new connection to prove that account works before a single record is written.
• Hardening SSH moves the daemon to a new port with the old one still listening until the new one has answered, so a mistake cannot lock you out.
• Every change to a machine Equific did not build is recorded as a reversible entry you can undo.

Protecting your account

• Two-factor authentication with an authenticator app, plus one-time recovery codes.
• Passkeys, so you can sign in without a password at all.
• Sign-in attempts are rate limited per account and per address.
• Changing security settings requires re-entering your password, even in an active session.
• An activity log records what was done, by whom and from where. It never records secrets.

Turn on two-factor authentication. It is the single largest difference you can make to how safe your servers are.

Token endpoints

A few endpoints are reachable without signing in, because a cron job or a git host has no session. In each case the token in the URL is the entire credential, so treat those URLs as passwords:

• Deploy webhooks, which additionally verify GitHub HMAC signatures and GitLab tokens, and are rate limited per site and per caller.
• Heartbeat check-in URLs for your scheduled jobs.
• The callback each provisioned server uses to report security events.

What we are not claiming

So that nothing here is read as more than it is:

• No third-party penetration test or security audit has been carried out.
• We hold no compliance certification — no SOC 2, no ISO 27001.
• There is no paid bug bounty.
• There is no service level agreement or guaranteed incident response time.

These are statements of fact about a young product, not a position on whether they matter. When any of them changes, this page changes with it.

Reporting a vulnerability

If you have found something, we want to hear about it before anyone else does.

Email [[ SECURITY CONTACT EMAIL ]] with enough detail to reproduce it. We will acknowledge within [[ ACKNOWLEDGEMENT WINDOW ]] and keep you updated until it is closed.

In scope

• The Equific application and its API surface.
• Anything that lets one account reach another account's servers or data.
• Anything that exposes stored credentials.

Out of scope

• Servers belonging to our customers. They are not ours to authorise testing against.
• Denial-of-service and volumetric testing.
• Social engineering of our staff or customers.
• Findings from automated scanners with no demonstrated impact.

Please do not access, modify or delete data that is not yours while investigating, and give us a reasonable chance to fix the issue before publishing. We will not pursue anyone who reports in good faith and follows this.