Trust and security

RentServers.com handles two kinds of data: the specs, invoices and contracts buyers send the sourcing desk, and the inference traffic that runs on Private LLM Hosting servers. This page sets out how each is protected. Live uptime is on the status page.

Private LLM Hosting

• Prompts and outputs are not stored. The gateway on each server records metadata only: time, API key, model, token counts, latency and status. It never writes request or response content to disk or logs.
• No training on your data. Your server runs the open-weight model you chose. Nothing you send is used to train any model.
• Dedicated hardware. The GPUs, memory and disks in your server serve only your organization.
• API keys are prefixed (rsk_live_) and carry a checksum so secret scanners can catch a leaked key. We store only a SHA-256 hash. Keys can be scoped, rate limited, set to expire and revoked; a revocation reaches the server within a minute.
• Signed key lists. Each server checks keys against an Ed25519-signed list. If it can't get a current list for 15 minutes, it stops serving rather than run on stale permissions.
• Mutual TLS. Servers make outbound connections only, authenticated by a private key generated on the server and a 24-hour certificate from our two-tier private CA, whose root key is kept offline. Certificates renew automatically, can be revoked from your console, and a server token is still required on top.
• IP allowlists can restrict API traffic, as well as account access, to your networks.
• Uptime is measured independently: a 1-token request to every server every minute, through the same gateway you use. Your console shows your servers' uptime, latency, GPU load and a changelog of every model, engine and maintenance change.

Your account

• Sign-in with a passkey, a single-use email link that expires in 15 minutes, or single sign-on.
• Passkeys (WebAuthn) for sign-in, two-step verification and confirming sensitive actions. They are bound to rentservers.com, so they can't be phished.
• Organization policies: require two-step verification for everyone, require phishing-resistant sign-in (passkeys or SSO only), and accept only device-bound passkeys such as hardware security keys.
• Single sign-on with SAML 2.0 or OIDC (Okta, Microsoft Entra ID, Google Workspace and others), on verified domains, with an option to require it. SCIM directory sync adds and removes people automatically; removing someone ends their sessions at once.
• Authenticator apps and single-use recovery codes are also supported where your policy allows them.
• Roles: owner, admin, developer, billing and viewer. Billing people never see API keys; developers never see invoices.
• Fresh checks before sensitive actions such as creating API keys, changing roles or changing security settings.
• Sessions end after 2 hours without activity and always after 24 hours. Cookies are HttpOnly and Secure, and every form carries an anti-forgery token.
• Desk access is visible. When our staff open your organization to help, every action is recorded in your audit log under their name. Staff accounts require two-step verification.

Audit log

• What's recorded: sign-ins, verification, passkeys, roles, API keys, SSO, server certificates, documents, billing, policy changes and desk access.
• Tamper-evident. Each organization's events form a SHA-256 hash chain, can't be edited or deleted, and are kept for at least a year. Every hour we sign the head of each chain with Ed25519; the public key is at /.well-known/rentservers-audit-keys.json, and our verifier tool, which we provide with the format specification, checks an export or stream offline.
• Streams to your SIEM within seconds: Splunk HTTP Event Collector, Datadog, Microsoft Sentinel, or any HTTPS endpoint with Standard Webhooks signatures. Native JSON or OCSF. Delivery retries with backoff, catches up after outages, and can replay history. Destination credentials are encrypted at rest.
• Export as CSV or JSON from the console, or through the read API.

Sourcing requests

• Providers bid blind. They see the technical spec only, never your name, email, phone or company, and never a file you uploaded. We introduce you only to the provider you pick.
• Files uploaded on the quote form are deleted after 90 days. Documents you keep in your account stay until you delete them.
• All traffic to rentservers.com is encrypted with TLS.

Compliance

• SOC 2: Type I in preparation against the Security trust services criteria. Status and auditor details are available under NDA.
• Data processing terms: Our Data Processing Agreement is available for signature: email quotes@rentservers.com. It covers processor obligations, no training on your data, the EU Standard Contractual Clauses with the UK Addendum, 30 days' notice of new subprocessors with a right to object, and breach notice within 48 hours.
• Security reviews: we answer SIG Lite, CAIQ and custom questionnaires. Email quotes@rentservers.com.
• Incidents: we notify affected customers without undue delay, and within 48 hours of becoming aware of a breach of their data.

Subprocessors

Locations, change notices and how to subscribe: subprocessors.

Report a vulnerability

Email quotes@rentservers.com with steps to reproduce. We reply within one business day and don't pursue good-faith research. Machine-readable contact: security.txt.