Built for hostile hosts. Honest about the trade-offs.
Salad has run customer applications on anonymous hosts since 2018. Our security model assumes the machine cannot be trusted, and protects both the workload from the host and the host from the workload. "All truth, no bullshit" is a brand value, so this page also says plainly what the network is not suited for.
Isolation in both directions.
Nodes. Salad nodes are high-end, underutilized, crowd-sourced computers. Our proprietary trust rating combines with your requirements, from hardware specifications to geolocation, to place each workload on the best available nodes.
Workloads. Nodes are partitioned with a hypervisor. Your workload runs inside an OCI-compatible container on a Linux virtual machine, isolated from Windows and every other process on the host. That protects your workload from potentially malicious software, and protects suppliers from potentially malicious workloads.
Layers, not a single wall.
Product security
Every product on the network is designed secure-by-default, with its own controls for the way it is used.
Platform security
From authentication to logging, the SaladCloud platform has multiple layers ensuring the security and privacy of your workloads.
Infrastructure security
Third-party vendors and service providers are held to industry-standard security and compliance requirements.
Trust rating system
Every node earns a rating from its behavior and performance. Only nodes that maintain a solid rating are eligible for workloads.
Shared responsibility
Salad, resource providers, and customers each carry part of the responsibility for the network's security and quality.
Data security
All data and environment variables are encrypted in transit and at rest with TLS and modern cipher suites.
SOC 2 Type I.
Salad Technologies is SOC 2 Type I compliant under AICPA standards and SSAE 18, audited by Prescient Assurance. Reports, policies, and sub-processors are available through the Trust Center.
Region-specific compliance
Nodes in 190+ countries make it possible to constrain workloads to the jurisdictions you require.
Heartbeat monitoring
Continuous monitoring assesses interruptions and failures before they affect your replica count.
Automatic reallocation
Resources are reallocated automatically when a node fails, keeping actual resource availability at your requested level.
Secure by default, product by product.
Salad Container Engine
- Container images and configuration encrypted at rest and in transit
- Registry credentials used once to cache the image, then discarded
- Inbound connections blocked by default
- Logs streamable to your external logging service for audit
Container Gateway
- Containers isolated from each other and exposed on a specific port through a WireGuard VPN
- Strong TLS required for clients
- Routes protected by dedicated DDoS hardware
Job Queues
- Requests and responses encrypted at rest and in transit
- Webhook callbacks require TLS and strong digital signatures
- Completed jobs deleted after 24 hours
Container Registry & Recipes
- Registry images encrypted; sessions authenticated with short-lived, fine-grained tokens
- Recipe images verified by Salad with automated security and compatibility checks
The honest answers.
What are the security risks of using SaladCloud?
Salad nodes are crowd-sourced, high-end gaming computers, which presents some security and privacy considerations depending on your use case. Traffic between your workload and the internet may be logged by intermediate networking equipment; with strong encryption the content is protected, but the destination IP address remains visible and a reverse DNS lookup may reveal the type of workload. We rely on Hyper-V and Linux container isolation and take many measures to detect and minimize threats, and there are technical approaches on your side that further reduce risk. Talk to our team before launching a new workload to review any concerns.
What happens if a host tries to access my container?
Constant host-intrusion detection watches for operations like folder access and shell opening. If a host attempts to access the Linux environment we automatically implode the environment and blacklist the machine. We are extending runtime detection with Falco.
Can you handle data subject to specific regulatory requirements?
Not all workloads fit the public network. Applications with highly specific regulatory or compliance requirements and a high data-to-compute ratio are often not a good fit for Community Cloud. For those, Salad Dedicated provides reserved, single-tenant hardware and Private Cloud keeps data inside your own network. Tell us your requirements and we will say which fits.
How do I report a vulnerability?
Use the abuse and security reporting page. We acknowledge reports promptly and work with researchers to resolve them.