Security

Security at Tsunamis Network is treated as a product surface, not a compliance checkbox. This page covers how we protect customer data and how to report a vulnerability.

Encryption

All customer traffic is encrypted in transit with TLS 1.3 by default. Data at rest is encrypted with AES-256 using keys managed by our HSM-backed key service. Inter-region traffic on our backbone is wrapped in additional mTLS.

Access

Production access is gated by hardware-backed SSO with mandatory MFA. Privileged actions are audit-logged and reviewed weekly.

Compliance

We're working toward SOC 2 Type II and ISO 27001 ahead of general availability. Penetration tests are run by an independent firm at least annually; reports are available under NDA to enterprise customers.

Reporting a vulnerability

Email security@tuuhub.com with details. Our PGP key fingerprint is published on request. We commit to a first response within 48 hours and to keeping you in the loop until resolution.

Operational issues

For network or service issues that aren't a security disclosure — peering problems, BGP escalations, or anything you'd page a NOC about — write to noc@tuuhub.com. The team is on-call from Melbourne and rotates with regional partners.

We do not currently run a paid bounty program, but we acknowledge responsible disclosure publicly and credit researchers in our changelog.