Work in progresspre-register via email

Security and your data

What stays in your project

The hub, its database and its backup in your S3 bucket.
Your Hetzner API tokens, encrypted with the hub’s data keys.
Your hosts, twins and their data.

What PaaSbox holds

Your account at the portal: your email address and team.
Your licence key, and the hub’s ID once the licence is activated.
Which releases your hub downloads.

PaaSbox never receives a Hetzner token, a device key or your app’s data. pbx never writes a Hetzner token, the licence key or the recovery key to disk.

How requests are proven

Devices sign every request with a P-256 key that stays in the TPM, the Secure Enclave or a protected key file (Devices and roles). Requests carry a timestamp and a nonce.
The admin plane (portal, API) listens only inside WireGuard and serves TLS from the hub’s own certificate authority, which each device pins at pairing.
Agents on hosts and twins sign their requests with their own keys. They open every connection themselves; hosts listen on no port for the hub.
Coding agents have keys of their own with a fixed ceiling (Coding agents).

Signed releases

Every release is a manifest signed by PaaSbox’s release keys. The hub checks each artefact against the sha256 in the signed manifest before it installs it; a download URL or a mirror cannot change what is installed. Security releases install whatever the licence’s state.

What is recorded

An audit line for every changing call, login and security event, with the device, the key and, for an agent, its integration. You can turn off the recording of read calls and source addresses; changing calls are always recorded. Lines are kept 400 days, in your hub.

Not done yet

Report a security issue as the support page says.