Security

Securing a public cloud platform like Fly.io is a hard problem, and we take it seriously. The Fly.io platform comes with built-in security like hardware isolation, private networking over WireGuard, and TLS termination.

---

​

Organization and app security

Security for customer organizations and apps.

• Organization Roles and Permissions: Understand what Members and Admins can do in a Fly.io organization, and how to manage access safely.
• Use SSO for organizations: Set up org-wide Single Sign-on with Google or GitHub.
• Remove a member from an organization: Remove a user from an organization and take steps to help keep the organization secure.
• Built-in TLS termination: You get TLS termination by default for your web apps.

​

Security extensions

Security add-ons from our extension partners.

• Application Security by Arcjet: Use the Arcjet security layer to protect your JavaScript app with just a few lines of code.

​

Tokens

Control access to your Fly.io organizations, apps, and Machines with tokens.

• Access tokens: Use tokens to manage access to organizations and apps.
• OpenID Connect: Use OpenID Connect (OIDC) to manage access to 3rd party services.

---

​

Fly.io platform security

Fly.io corporate security, compliance, and shared responsibility.

• Shared responsibility model: An overview of the separation of responsibilities for security on Fly.io.
• Fly.io security practices and compliance overview: Learn about our security practices for the Fly.io platform.

---

​

Reporting a vulnerability

If you believe you have found a vulnerability in any part of Fly.io, email security@fly.io. If you need an encrypted channel, ask and we will set one up. Our machine-readable contact file is at fly.io/.well-known/security.txt. What to include: the affected component or hostname, steps to reproduce, and what you were able to access. Do not access, modify, or exfiltrate customer data beyond what is needed to demonstrate the issue, and do not test against other customers’ applications. What to expect from us: we acknowledge reports within 3 business days and tell you when the issue is fixed. We do not run a bug bounty program and do not publish reporter acknowledgments. We ask that you give us a reasonable window to fix the issue before publishing details, and we will tell you if we need more time. For security questions that are not vulnerability reports, the same address works.