Security

Hetscale is a control plane. It reads metrics and calls the Hetzner Cloud API in your project. Requests from your users go from your load balancer to your servers, as they do today. Hetscale is not in that path, cannot see it, and an outage on our side cannot interrupt it.

Observe uses a read-only Hetzner project token. It cannot create, change or delete anything; that is enforced by Hetzner, not by us. Hetzner tokens come in exactly two levels, Read and Read & Write, and there is no upgrade from one to the other: going Live means you create a second token.

Rehearsal, Propose and Live use a Read & Write token for the project. It is stored with envelope encryption, never placed in job payloads, and used only for the API calls the log shows. Authorization headers are scrubbed from logs; a token fingerprint detects the same token being connected to more than one organisation.

Revoking the token in the Hetzner Console stops everything immediately. Nothing on your servers depends on us.

Hetscale deletes only servers it created, whose labels and name match its ledger. Anything else in the project is listed, never touched, even when it sits behind the same load balancer. A node is never deleted while it is still a load balancer target.

delete only when all three match the ledger:
  label   hetscale.dev/managed = true
  label   hetscale.dev/group   = <group id>
  label   hetscale.dev/node    = <node ulid>
  name    hetscale-<group>-<ulid>
any mismatch → aborted, security alert, server listed and never touched

During creation a fourth label, hetscale.dev/op, ties the server to the write-ahead intent that requested it; a server without a matching intent is quarantined, removed from the load balancer and left for you to confirm, never deleted. Every Hetzner call goes through one guarded client that never exposes rescue mode, password resets, console access, or deletion of volumes, networks, firewalls, load balancers or floating IPs. A server protected against deletion in Hetzner is a hard stop, never retried.

• SSH private keys. Hetscale does not log in to your servers.
• Tokens in job payloads or logs.
• Request payloads or customer traffic; none of it passes through us.
• Application secrets. Your deploy tool owns them; the one disclosed exception is the snapshot adapter, where secrets live inside your own snapshot in your own project.

Metrics, decisions and the action log are processed and stored in the EU. Every organisation has an insert-only audit log with a hash chain that records Hetzner action ids; operator access to customer data requires a second approval or a delay plus customer notification.

The data processing agreement describes categories, retention and sub-processors. It is published, with the sub-processor list, before the first paying customer.