Security
Quiet about it,
serious about it.
- 01
Your GPUs are yours
Every machine is its own virtual machine with whole GPUs, never time-sliced between customers. It runs on a cloud provider Koi rents from, and only the SSH keys you choose can log in as koi.
- 02
Encrypted in transit
The console, the API and this site are only served over HTTPS. Getting your data to and from your machine is over SSH, or whatever you choose to run on it.
- 03
Your data stays your data
We don’t look at, sell or train on your code, weights or datasets. When a machine is terminated or reclaimed, its disk is deleted with it, so keep anything you need somewhere else.
- 04
Nothing worth stealing
Sign in with GitHub or Google, a password, or a link that’s emailed to you and works once. Passwords, API keys and sign-in links are stored hashed, so we couldn’t read them back if we wanted to. A new password account works only once its email is confirmed, so nobody can claim your address before you do.
- 05
Keys with limits
API keys are shown once and can be revoked at any time. Give one a spending limit before handing it to a script or an agent, and it can only cost so much. A key can’t raise its own limit.
- 06
Your card stays with Stripe
Stripe handles payments, on its own page. Koi never sees your card number, and you can remove a saved card by turning automatic top-ups off.
Responsible disclosure
Found something?
Email security@koicompute.co with what you found and how to reproduce it. An engineer replies within two business days and keeps you updated until it’s fixed.
Test against your own account and data, stop as soon as you can show the issue, and give us a reasonable time to fix it before you publish. Do that, and we won’t pursue legal action. We’ll thank you publicly too, if you’d like.
Machine-readable: /.well-known/security.txt