What we do with
your environments

Practices, as built

• You choose where it runs

  Every environment is placed in the cloud and region its owner picks, and its servers, database and files stay there. Rykloud does not move them.

• Isolation per environment

  Each environment has its own network, firewall, keys, database and bucket. Its cloud control endpoint admits only Rykloud's runner. For a separate bill or boundary, run it in a dedicated account Rykloud makes for you, or in your own.

• Your own account, without your keys

  To use your AWS account or Google Cloud project, you grant Rykloud a role or service account, with an external id unique to your organisation. Rykloud never asks for an access key, a password or your root account, and stores no cloud credential of yours.

• Mutual TLS inside

  Rykloud's control plane and provisioner reach its workflow service only over mutual TLS, each with a certificate of its own from Rykloud's own authority, renewed automatically.

• Spend only with a person's approval

  Nothing is created until an owner of the organisation approves the exact itemised price. The database itself refuses any other path. Billing starts only once the cloud has created the environment.

• An audit log that cannot be edited

  Every action is recorded with who did it, from where, what happened, how long it took, what it changed in the price, and a reference. Records are append only. Owners and admins filter it and download it as CSV or JSON.

• Encrypted saved copies

  Infrastructure state is encrypted before it leaves the machine that wrote it. A stopped environment's workspace copies are encrypted with that environment's own key; every saved copy is kept in object storage encrypted at rest.

• One account, single sign-out

  People sign in once with their Rykon account at id.rykloud.com. Signing out there signs them out of the console too, and owners remove people from an organisation in one place.

• Signed releases and SBOMs

  Every image Rykloud builds is signed by digest and carries a signed SPDX software bill of materials, and every environment checks both before it starts.

  Being switched on: the checks run and report today, and become mandatory once the release signing key is in place.

• Errors that say what to do, and nothing of ours

  What you read about your environment is written for you: what happened, what to do next, and a reference. The internal detail stays with Rykloud, found by that reference when you quote it to support.

Where your data lives is your choice

The regions the console offers today. You pick one for each environment, and see its price before anything is made.

Microsoft Azure regions are priced in the console and not yet offered. New regions are listed here as they open.

Subprocessors

The companies that process data for Rykloud, what for, and where. A new one is added here before it holds customer data.