Platform Protections
Voroa security overview: DDoS, HTTPS, 2FA and backups
What Voroa does to protect your services and data: DDoS protection, HTTPS, inbound IP rules, encrypted secrets, account 2FA, team roles and daily backups.
This page lists the protections Voroa runs for every service, and the controls you can turn on yourself. Each item links to its own guide.
Traffic and attacks
- DDoS protection. By default we serve every service’s Voroa address through an edge network, which absorbs floods of unwanted traffic before they reach your service. You can turn it off for any service in its settings. On a paid plan, your custom domains can use it too. See DDoS protection.
- Per-visitor rate limiting. Our proxy limits each visitor’s request rate, so one badly behaved client cannot take your service down for everyone else.
- Inbound IP rules. Allow only the addresses you choose to reach a service - an office network or a partner’s servers, for example. Everyone else is refused before the request reaches your code. See Inbound IP rules.
- Maintenance mode. Put a service behind a holding page while you work on it, without redeploying. See Maintenance mode.
Encryption in transit
- HTTPS on every domain. Your Voroa address and every custom domain you add get a TLS certificate automatically, and it renews on its own. See TLS certificates.
- Strict HTTPS (HSTS). An optional setting that tells browsers to only ever use HTTPS for your custom domains.
Your secrets and data
- Secrets are encrypted and write-only. We encrypt environment variables and secret files at rest. Once you save a value, you can replace it, but nobody can see it again - not you, not your team. (Your managed database password is the one exception; see its guide.)
- Isolation. We keep every account’s services, databases and settings separate from every other account’s.
- Where stored data sits. We store your services, databases and backups on servers in India. Object Storage files and your service and build logs are stored in the Asia-Pacific region on a best-effort basis. Requests may travel through the edge network on their way to your service.
- Backups. We back up managed databases every day and encrypt the backups.
Your account and team
- Two-factor authentication. Protect sign-in with an authenticator app or a passkey, with recovery codes for when you lose your phone. See Two-factor authentication.
- Sign in with Google or GitHub, or with an email one-time code.
- Team roles. Invite teammates with a role, so each person can do only what their role allows - for example, deploy without seeing billing. See Team members.
- Audit logs. See who deployed, changed a setting or invited a teammate, and export it as CSV, on the Growth, Scale and Custom plans. See Audit logs.
Our own servers
The servers that run the Voroa dashboard and API accept outside traffic only through our edge network. We manage this; you do not configure it.
What is not available today
- Single sign-on (SSO) through your company identity provider.
- A published penetration-testing report.
If one of these is a requirement for your security review, contact support before you move production to Voroa.