Security is part of the product.

SolidRPC operates blockchain infrastructure. Security is part of the product, not an afterthought.

01 / Infrastructure

Production and deployment controls

01Our nodes run on a mix of dedicated bare-metal hosts and cloud servers in EU data centers; for some networks we also rely on reputable third-party RPC and beacon providers.
02Every change to the production cluster is version-controlled and applied through an automated reconciliation pipeline. No ad-hoc shell on a server.
03Secrets are encrypted at rest and never stored in plain text.
04Daily encrypted off-site backups for both cluster state and chaindata, retained per our data retention policy.

02 / Application

Access, credentials, and edge controls

01TLS 1.2+ everywhere; HTTPS-only redirects on every public hostname.
02API keys are stored as hashes. You can revoke any key at any time from the dashboard.
03API keys can be sent in a request header so credentials do not need to appear in endpoint URLs. See the authentication guide.
04Passwords are hashed with bcrypt.
05JWT auth signed with a secret held only in-cluster.
06Rate limiting at the edge and per API key.

03 / AI SRE agent

Guardrails for automated operations

01Scaling, version upgrades, and code-level fixes require human approval by default; the agent recommends, engineers sign off.
02A dry-run mode disables every destructive action with one toggle.
03Daily budgets cap how much the agent can do in any 24-hour window.
04The agent cannot scale a chain to zero; that’s blocked at the tool layer before any API call leaves the agent.
05Every cluster mutation the agent performs is logged for at least 30 days with full reasoning, available to the on-call team.

04 / Disclosure

Reporting a vulnerability

Email [email protected]. We respond within 2 business days. Please give us a reasonable window to remediate before public disclosure. We do not currently run a bug bounty program.

For how we handle personal data, see our Privacy Policy.