Most platforms secure Kubernetes with settings you must get right. Aether removes the attack surface instead: no shell exists on nodes, no control-plane VM exists to reach, no shared ingress proxy exists to cross. These aren't hardening options — they're the only way the platform is built.
The best infrastructure is the infrastructure you cannot see, cannot reach, and cannot break.
All seven are configured automatically on every cluster bootstrap — you don't write a single line of security YAML to get them.
Every hypervisor enforces firewall rules at the virtualization layer, under the VMs — closing ports your workloads never see.
Each cluster gets its own layer-2 network and private subnet. There is no shared segment for lateral movement between tenants.
eBPF-based networking with L3–L7 policy inside the cluster, ready for your own NetworkPolicies from the first pod.
Talos Linux: no SSH, no shell, no package manager, read-only root, API-only management. There is nothing to log in to.
Your API server runs as hardened pods in our management cluster with a per-tenant, role-isolated datastore. No control-plane VM exists, so none can be attacked.
Aether Identity single sign-on with org-scoped roles and MFA for the portal, the API and kubectl. Access is revoked centrally in one place.
Every LoadBalancer Service gets its own load-balancer VM and IP with per-service firewalling — a compromise of one tenant’s edge is not a path to yours.
Each Aether region is a complete, independent deployment of the whole platform — compute, storage, identity, registry, observability and billing. You choose where your data lives, and it stays there: there is no cross-region data path to configure wrongly, because there is no cross-region data path at all.
Today Aether runs in the EU, with regions planned for the US, Africa and Asia. Because the guarantee is carried by the per-region architecture rather than by policy, every new region inherits it unchanged: data created there stays there, in that jurisdiction. Aether itself is EU-owned and EU-operated — in EU regions your data is not subject to the US CLOUD Act, and GDPR residency comes without extra contracts.
Static analysis and secret scanning on every change, pinned and scanned container images, restricted pod security standards, least-privilege service accounts, and continuous datastore backups. Vulnerability scanning runs on every image pushed to your registry.
SOC 2 Type I certification, a standard GDPR data-processing agreement with a public sub-processor register, and ISO 27001 — sequenced ahead of the second region. Ask us where these stand before you buy; we'd rather show you the plan than imply the badge.
The architecture holds up to scrutiny — the docs explain exactly how everything works.