Silk Compute Trust Center

Silk Compute maintains a security program to protect customer data. Here you can find our compliance work, security controls, subprocessors and security documents.

[email protected]Privacy Policy

Infrastructure security

19 controls

Control	Status
Production application access restricted System access to production is restricted to authorized administrators.	In place
Production database access restricted Privileged access to the production database is restricted to authorized administrators. Application services reach it through restricted file permissions.	In place
Unique production database authentication enforced Access to production datastores requires a unique SSH key.	In place
Encryption key access restricted Encryption keys and production secrets are readable only by authorized administrators and the one service that needs each of them.	In place
Firewall access restricted Privileged access to the firewall is restricted to authorized administrators.	In place
Production OS access restricted Privileged access to the operating system is restricted to authorized administrators.	In place
Production network access restricted Privileged access to the production network is restricted to authorized administrators.	In place
Unique network system authentication enforced Access to production servers requires a unique SSH key. Password logins and remote root logins are disabled.	In place
Network firewalls utilized The server firewall denies inbound traffic by default. Public web traffic reaches production only through Cloudflare's network.	In place
Network segmentation implemented Application services listen only on the local interface behind a reverse proxy, and each service runs as its own system user.	In place
Network and system hardening standards maintained Services run sandboxed with reduced privileges, read-only code and resource limits, from hardening configuration kept in version control.	In place
Denial-of-service protection utilized Cloudflare protects every public endpoint against denial-of-service attacks.	In place
Intrusion detection system utilized Repeated failed SSH logins are blocked automatically. A daily integrity check alerts on changes to accounts, SSH, system services, scheduled tasks, listening ports and system packages.	In place
Log management utilized Web server and service logs are collected in the system journal and used to investigate abuse and errors.	In place
Infrastructure performance monitored An external monitor checks availability every five minutes and alerts on outages and missed health reports.	In place
Service infrastructure maintained Security updates for the operating system and server software install automatically every day.	In place
Backups performed and encrypted The database is backed up every day, encrypted, to separate cloud storage, and each backup is kept for 30 days.	In place
Production deployment access restricted Only authorized administrators can deploy to production.	In place
DNS security extensions enabled The domain is signed with DNSSEC, so resolvers can verify DNS answers.	In place

Organizational security

5 controls

Control	Status
Unique account authentication enforced Every administrator signs in with a named personal account. The shared root account cannot sign in remotely.	In place
Administrator MFA enforced The admin dashboard requires a one-time code from an authenticator app, bound to the signed-in session.	In place
Administrator actions logged Every change made from the admin dashboard is recorded in an audit log.	In place
Information security policies established Written policies cover access control, change management, incident response, vulnerability management, data retention, encryption, vendors and workstations, and are reviewed every year.	In place
Security alerts reviewed Monitoring and integrity alerts go to the team inbox for review.	In place

Product security

12 controls

Control	Status
Data transmission encrypted All connections use TLS, and browsers are instructed to use HTTPS only (HSTS).	In place
Data encryption utilized The production database is encrypted at rest with SQLCipher (AES-256).	In place
Support data encrypted at rest Support tickets and their attachments are encrypted in the database with AES-256-GCM.	In place
Credentials stored as hashes Passwords and API keys are stored only as hashes. An API key is shown once, when it is created.	In place
Email verification required Every account confirms its email address before it can sign in.	In place
Password policy enforced Account passwords must be at least 8 characters long.	In place
Customer MFA available Customers can turn on two-factor sign-in with an authenticator app, with one-time backup codes.	In place
Rate limiting enforced Sign-in, sign-up and password resets are rate limited, and addresses that fail API key checks repeatedly are blocked for a time.	In place
Bot protection utilized Sign-ups are checked for bots before an account is created.	In place
Request size limits enforced Oversized requests are rejected before they reach the application.	In place
Security headers enforced Pages send a content security policy, block framing by other sites, and disable content type sniffing.	In place
API key spending limits available Customers can set a spending limit on any API key and revoke a key at any time.	In place

Internal security procedures

9 controls

Control	Status
Change management procedures enforced Every code change is tracked in version control, and production ships only from the main branch.	In place
Configuration management system established Server configuration, including the firewall, SSH, services and web server, is kept in version control and installed through reviewed scripts.	In place
Database changes backed up A database backup is taken before every schema change.	In place
Penetration testing performed An internal penetration test of the platform and API was completed in November 2026.	In place
Incident response plan established A written incident response plan covers detection, severity, containment, customer notification and review.	In place
Continuity and Disaster Recovery plans established A written plan covers restoring the service from encrypted off-site backups after the loss of the database or the server.	In place
Continuity and Disaster Recovery plans tested Restoring from backup is tested every quarter.	In place
Vulnerability disclosure process established Anyone can report a vulnerability by email, encrypted with our published PGP key.	In place
Incident notification committed If a security incident affects customer data, we notify the affected customers.	In place

Data and privacy

6 controls

Control	Status
Prompts and outputs not stored Prompts and model outputs pass through our servers and are not stored.	In place
Customer data not used for training Silk Compute never uses prompts or model outputs to train models.	In place
Customer data deleted upon leaving Deleting an account removes the account, API keys, usage and payment history from the database right away.	In place
Data retention procedures established For each request we keep only billing records: the model, token counts, cost, time and API key. Server logs are removed automatically as they age.	In place
Payment card data not stored Card payments are processed by Stripe. Card numbers never reach our servers.	In place
No data sale or advertising trackers We never sell customer data, and there are no analytics or advertising cookies.	In place