Security
Security at Subnomic
Security isn't a feature bolted on afterwards — it's how the product is built. Here's how we protect your workspace, your infrastructure and your data.
No inbound ports
The agent dials out over TLS and refuses to dial anything outside its allowlist. Your hosts don't listen for us — there's nothing to port-scan.
Scoped, expiring credentials
Deploy tokens, storage keys, registry robots and agent accesses are scoped to what they need, can expire, and are shown once.
Encrypted in transit and at rest
TLS in transit. Stored credentials — database passwords, access key secrets, signing keys — are encrypted at rest.
Session recording
Terminal, pod-shell and database sessions are recorded and replayable, attributed to the person who opened them. Database recordings never keep result rows.
Permissions, not privileges
Roles are sets of permissions: reading a database and writing it, watching a session and taking it over, are separate grants.
Passkey sign-in
Passkeys (WebAuthn) for phishing-resistant sign-in, and TOTP two-factor for accounts that still use a password.
Architecture
Your own servers and clusters are reached through an agent that opens one outbound, TLS-encrypted connection to Subnomic, authenticated with the agent’s own token. Terminal, database, Kubernetes and internal-app traffic travels back over that connection. Because the agent always initiates it, there is no inbound port for an attacker to reach — even if they know your IP address. Hosted sites, object storage and the container registry run on Subnomic’s own infrastructure and are reached over HTTPS.
Identity & access
People sign in with passkeys (WebAuthn) or a password plus TOTP two-factor. Automation uses scoped credentials — API keys, storage access keys, registry robots and agent accesses — each limited to what it needs and revocable on its own. Agent accesses used by Runa, workflows and MCP clients can never exceed the permissions of the person who created them. On the Enterprise tier, just-in-time access adds reviewer approval and automatic expiry, with a logged break-glass path for emergencies.
Data protection
Traffic is encrypted in transit with TLS, and stored credentials are encrypted at rest. The agent reports operational metrics and carries the sessions you open; it doesn’t read application data on its own. Database recordings keep query text, row counts and timing — never result rows — and obvious secrets are redacted from the query text. Object storage is deduplicated within a workspace and never across workspaces.
Operational security
- Least-privilege access to production systems for our team;
- Audit logging of administrative actions;
- Secure software development practices and dependency monitoring;
- Regular review of access and controls.
Compliance
We don’t claim certifications we don’t hold. Evidence packs help you answer your own audits with access reviews, session inventories and the audit log, and we’re glad to share documentation for your security review — contact security@subnomic.com.
Sub-processors
We use a small set of vetted sub-processors to operate the Services, each bound by data protection obligations. The current list is on our Subprocessors page.
Reporting a vulnerability
Found a security issue? We welcome reports through our Responsible Disclosure process. Please do not disclose issues publicly until we've had a chance to remediate.