Security

Credentials denv holds

Provider kind	What denv gets	Scope
AWS	A role it assumes, with an external id	Launch and terminate instances tagged denv:managed=true; read quotas and prices; read weights buckets you grant
Google Cloud	Workload identity federation to a service account	Same, through roles you grant
Azure	A service principal	Same, in the denv-managed resource group
Oracle Cloud	Policy statements	Same, in the compartments you grant
GPU clouds	Your API key, or denv's own account	Encrypted at rest; used only by the provisioner
Own machines	A one-time join token per host	Becomes a per-host certificate

Revoke any of these at any time. Running hosts keep serving until you remove them.

What denv can do on a host

denvd runs a fixed set of commands: fetch and verify weights and images, start and stop engines, drain, warm up, check, clean up, report, upgrade itself. It does not run arbitrary shell commands from the control plane and opens no inbound public port. See denvd.

Where data lives

Data	Where
Weights	Your storage; regional cache near each fleet; host disks
Engine images	denv's artifact store; host disks
Prompts and outputs	In memory on the router and your hosts while a request runs
KV cache	GPU memory, host memory and NVMe on your hosts
Request logs	Nowhere, unless you turn on logging for a stage
Usage records	denv's control plane: token counts per request and customer, no content
Parity runs	Suite prompts and both sides' outputs, in the report

With the router in your own account, prompts and outputs never pass through denv's infrastructure.

Customers and keys

• Each key belongs to one customer and can be scoped to an environment or stage.
• Keys are stored hashed; the full key is shown once.
• Rate limits are enforced per customer at the router. Requests over a limit get 429 and are not metered.
• One customer's requests can share KV cache prefixes with another's only within a stage you control; cached content is never returned to a different request, only reused as computation. Set kv-cache.share: replica to disable sharing.

Metering integrity

Token counts come from the router, using the tokenizer of the release, not from the engine alone. Each usage record carries the release id. Exports and usage.daily webhooks let you reconcile against your own billing.

Tenant isolation

Every object belongs to one organization; every API call is checked against it. A host's command queue is bound to its certificate. Hosts are never shared between organizations, including instances launched through denv billing.

Residency

A stage with residency refuses fleets outside it, keeps weights caches inside it, and its router never fails over outside it.

GPU providers you do not control

Whoever operates a host can, in principle, read GPU and host memory. Choose providers you trust for sensitive workloads. Confidential computing for GPUs is not available in denv yet; it may be added where providers support it.

Compliance

denv does not hold a SOC 2 report today. A SOC 2 Type I is planned.

Reporting a vulnerability

See /.well-known/security.txt.