How Nuvlo reaches your servers
Your servers run in your own cloud account, such as Hetzner, DigitalOcean or Vultr, or on a server you already rent. Nuvlo does not sell or resell servers, and your cloud provider bills you directly.
Nuvlo installs no control panel on your server and opens no port for itself. It connects over SSH with a key made for that server, and the server sends its usage figures out to Nuvlo. The dashboard runs on Nuvlo's own infrastructure, so there is no admin page on your server for anyone to attack.
What every server gets
- A firewall that allows only SSH, HTTP and HTTPS.
- SSH with keys only: password sign-in is off and root can only sign in with a key.
- fail2ban, which blocks addresses after repeated failed sign-ins.
- Automatic installation of Ubuntu security updates.
- HTTPS certificates for your sites, renewed automatically.
Updates and security fixes
Ubuntu security updates install on each server every day. Nuvlo also checks every hour for new critical vulnerabilities, sees which servers run an affected package, and rolls fixes out across servers in stages, stopping at the first failure. When a fix needs a restart, you choose the hour, or restart yourself.
When Node.js publishes a security release, sites on Nuvlo move to the fixed version of the same major release, one server at a time. A site that fails its health check goes back to the version it ran before.
Your credentials and data
Cloud provider tokens, database passwords and other secrets are encrypted with AES-256-GCM before they are stored, and are never shown in full again. Two-factor sign-in is available for every account, and staff tools ask for it again every 30 minutes.
Team members get the access their role allows, and changes to servers, sites and the team are recorded in the activity log. AI agents connected to your account can read, but changes they propose wait for your approval unless you allow undoable changes to run on their own.
Backups
Backups go to a storage bucket in your own account, such as Hetzner, Cloudflare R2, Backblaze B2 or any S3-compatible storage. Nuvlo keeps no copy. You choose how often they run and how many to keep.
Where Nuvlo runs
Nuvlo is run by Terrapixel in Wien, Austria. The application runs at Contabo GmbH, Germany, and its database is in the EU (Paris, France). Payments, email and AI features use providers listed on the subprocessors page, some of them in the USA.
If you leave
Your servers and sites keep running if you cancel a plan or delete your Nuvlo account: they are yours, in your cloud account. Add your own SSH key under SSH keys to keep full access without Nuvlo.
When you move to a smaller plan, anything over its limit is paused in Nuvlo after a three-day notice. Paused servers and sites keep running; Nuvlo only stops deploying, backing up and updating them.
Prices
If we raise the price of a plan, subscriptions that started at the earlier price keep paying it.
Reporting a security problem
If you find a security problem in Nuvlo, email hello@nuvlo.dev with the details and how to reproduce it. We reply within three working days and tell you when it is fixed. Please do not access other people's data or disrupt the service while testing. The same contact is published at /.well-known/security.txt.