Security and trust
Security you can read. Evidence you can request.
What protects your private cloud, who can touch what, and which attestations stand behind the platform. The full reports are available under NDA.
Attestations
Attested, in progress, and not yet.
SOC 2 Type II
Attested with an unqualified opinion by Prescient Security, period November 1, 2025 to January 30, 2026. No exceptions noted. Full report under NDA.[1]
HIPAA
A business associate agreement is available for covered workloads.
CMMC Level 2
Pursued. No assessment held yet. Controlled data stays on devices you own.
FedRAMP
Aligned and pursuing Moderate. No authorization to operate holds today, and no agency sponsor stands behind one.
Who can touch what
Access is a table, not a promise.
| Layer | Who holds it | What they can see |
|---|---|---|
| Your data | You | Everything |
| Your private cloud and network | You plus the people you add | Your workloads, published only where you choose |
| Your devices | You, or Triple X for Triple X Cloud Nodes | The hardware, not the data |
| The platform underneath | NexQloud Technologies, Inc., the platform operator | That a workload exists, how big it is, what it costs. Not what is in it. Operator actions are logged. |
| Sealed runs | No one, including the operator | Data stays unreadable while in use; a receipt records the run |
Controls that ship today
What you can set from the console.
- One private network per customer. Nothing reachable unless you publish it.
- HTTPS ingress by allowed domain, with certificates renewed for you.
- Databases on private endpoints by default; public endpoint optional, chosen at creation.
- SSH by key only: ed25519 or RSA, registered account-wide.
- Storage keys scoped to named buckets; registry tokens per project; secrets shown once; revoke and they stop at once.
- Budgets with alert thresholds and email notice.
- Placement pinned before anything is scheduled; failover follows the policy you set.
- Tier A capacity reserved for one customer, with vetted operator access and continuous control evidence.
Ask us
The questions a security review asks.
Where is my data processed?
Where you placed it: on the devices you chose or the Triple X Cloud nodes in your private cloud. Placement is pinned before anything runs and failover follows your policy.
Is data encrypted at rest?
Storage at the edge is encrypted. The published documentation does not yet state server-side encryption for object storage, so ask for the written statement with your private cloud rather than reading it here.
Who are the subprocessors?
The platform operator, NexQloud Technologies, Inc., and the providers that host this site and send our email. GPU capacity, when quoted, names its operator before signature. The list is available in writing.
Do you penetration test?
The platform runs an annual third-party penetration test; the attestation letter is available under NDA.
How do I report a vulnerability?
Write to Triple X through the contact page with the subject "Security". We acknowledge within two business days.
What happens in an incident?
Notice to you under the service agreement, with the facts we hold and the actions taken. The SOC 2 period above recorded no security incidents.
Get started
Request the evidence.
The SOC 2 report, the penetration test letter and the subprocessor list, under NDA.
- 01
Join the waitlist.
Tell us what you want to run and where. No credit card.
TakesTwo minutes
- 02
Launch a machine or a cluster.
From the console, the API or the CLI.
Takes2 to 5 minutes
- 03
Bring your own servers.
Triple X sets up your private cloud on them.
WhoTriple X
We never ask for your root credentials, API keys or bank details by email.
What to ask any provider
The security review, in seven rows.
Ask every provider the same seven questions and compare the documents, not the answers.
| Ask | Triple X Cloud | Where to verify |
|---|---|---|
| SOC 2 Type II? | Attested, unqualified opinion, no exceptions | Report under NDA, period to January 30, 2026 |
| HIPAA? | Business associate agreement available | The agreement, from Triple X |
| CMMC Level 2? | In progress; no assessment held | This page; ask in writing |
| Penetration tested? | Annually, by a third party | Letter under NDA |
| Who can read my data? | You; the platform sees size and cost only | Access table on this page |
| Who are the subprocessors? | Platform operator, site host, email sender | Written list in the evidence pack |
| How are secrets handled? | Shown once, scoped, revocable at once | Console; storage and registry documentation |
Questions
What buyers ask before they sign.
In the order they come up. Every answer ends with where to check it.
10 answers
All questionsWhich attestations does the platform hold?
SOC 2 Type II, attested with an unqualified opinion by Prescient Security for the period November 1, 2025 to January 30, 2026, no exceptions noted. A HIPAA business associate agreement is available. CMMC Level 2 is in progress. Nothing else is claimed.
Proofthe SOC 2 Type II report, available under NDA through the contact page.[1]
Can I read the SOC 2 report?
Yes, under NDA. Write through the contact page and ask for the evidence pack: the SOC 2 Type II report, the penetration test letter and the subprocessor list. The word is attested, because no certificate exists for SOC 2.
Proofthe evidence pack sent under NDA after a contact-page request.[1]
Who can see my data?
You and the people you add to your private cloud. The platform underneath sees that a workload exists, its size and its cost, not what is in it, and its operator actions are logged. In a Sealed run, data stays unreadable while in use, even to the operator.
Proofthe access table on this page and the logging controls in the SOC 2 Type II report under NDA.[1]
Is my data encrypted?
In transit, yes, with HTTPS ingress and certificates renewed for you. At rest on the edge, yes. The published documentation does not yet state server-side encryption for object storage, so ask for the written statement with your private cloud before you rely on it.
Proofthe ingress and certificate settings in the documentation and a written encryption statement from Triple X.[2]
Can I run HIPAA workloads?
A business associate agreement is available for covered workloads. The platform is HIPAA-ready; no HIPAA certification exists for any provider. Private endpoints by default and one network per customer cover the usual technical safeguards; your policies cover the rest.
Proofthe business associate agreement sent by Triple X and the private endpoint default in the database documentation.[3]
Can I hold controlled defense data here?
CMMC Level 2 is in progress; no assessment is held yet. Until one is, controlled data stays on devices you own, inside your private cloud, under a policy that never moves it elsewhere. Ask Triple X in writing before you place it.
Proofthe CMMC status on this page and the acquisition rule timeline, with Phase 2 assessments paused on July 13, 2026.[4]
Do you penetration test?
The platform runs an annual third-party penetration test. The attestation letter is in the evidence pack under NDA, alongside the SOC 2 Type II report. The SOC 2 period recorded no security incidents.
Proofthe penetration test letter, under NDA through the contact page.[1]
Who are the subprocessors?
The platform operator, named on the Sovereign page and in the footer, plus the providers that host this site and send our email. GPU capacity, when quoted, names its operator before you sign. The full list is available in writing.
Proofthe subprocessor list in the evidence pack and the operator named in any GPU quote.
Which controls can I set myself?
One private network per customer; publish only what you choose. HTTPS ingress by allowed domain. SSH by key only. Storage keys scoped to named buckets, registry tokens per project, secrets shown once and revocable at once. Budgets with alert thresholds. Placement pinned before scheduling.
Proofthe controls list on this page and the storage, registry and database documentation, August 1, 2026.[5]
What happens in an incident, and how do I report one?
You get notice under the service agreement with the facts we hold and the actions taken. To report a vulnerability, write through the contact page with "Security" in the first line; Triple X acknowledges within two business days.
Proofthe incident notice clause in your service agreement and the acknowledgement you receive from Triple X.
No questions under this term yet. Ask Triple X.