Security

Security at AnycastEdge

Platform security

• All edge traffic is TLS 1.2+ with modern cipher suites; TLS 1.3 by default where supported.
• edge-js functions run in per-tenant V8 isolates with CPU and memory limits; no shared mutable state between tenants.
• Production access uses hardware-key MFA and short-lived credentials; all changes go through review and audit logging.
• Edge logs truncate client IPs at ingestion (see the Privacy Policy).

Reporting vulnerabilities

Report issues to security@anycastedge.duckdns.org (see also /.well-known/security.txt). We acknowledge within 24 hours and aim to triage within 72. We operate a safe-harbor policy for good-faith research.

Compliance status

• GDPR: data processing as described in the Privacy Policy; DPAs available for Team and Enterprise customers.
• SOC 2 Type I: in progress, target 2026-Q3.
• ISO 27001: on the roadmap; scoping complete.
• We do not claim certifications we have not yet earned — ask us for current attestations at any time.