Security

Hydron takes security seriously at every level — from account protection to data encryption to server hardening. This page covers the security features available to you and best practices.

Two-factor authentication (2FA)

Two-factor authentication adds an extra layer of security to your account. Even if someone knows your password, they can't sign in without your 2FA code.

Enabling 2FA

1. Go to Settings > Security
2. Click Enable Two-Factor Authentication
3. Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, etc.)
4. Enter the 6-digit code from your authenticator to confirm
5. Save your backup codes in a secure location

Using 2FA

After enabling 2FA, you'll be asked for a 6-digit code each time you sign in:

1. Enter your email and password
2. Open your authenticator app
3. Enter the current 6-digit code
4. Click Verify

Backup codes

When you enable 2FA, you receive one-time backup codes. These can be used if you lose access to your authenticator app:

• Each code can only be used once
• Store them in a secure location (password manager, printed copy in a safe)
• Generate new backup codes from Settings if you run out

Disabling 2FA

1. Go to Settings > Security
2. Click Disable Two-Factor Authentication
3. Enter your current 2FA code to confirm
4. 2FA is now disabled

Session management

Active sessions

View all your active sessions from Settings > Sessions:

• See which devices and browsers are signed in
• View IP addresses and locations
• See when each session was last active
• Sign out individual sessions or all sessions at once

Session security

Hydron protects your sessions with:

• Token rotation — Refresh tokens are rotated on each use
• IP validation — Sessions are tied to IP addresses (optional)
• User agent validation — Sessions are tied to browser fingerprints (optional)
• Automatic expiry — Inactive sessions expire after a set period

Data encryption

At rest

• Credentials — Server SSH keys and API credentials are encrypted with AES-256
• Environment variables — Sensitive values are encrypted before storage
• Passwords — Hashed with bcrypt/argon2 (never stored in plaintext)

In transit

• HTTPS everywhere — All connections use TLS 1.2 or 1.3
• SSH — Server communication uses SSH with key-based authentication
• API calls — All API traffic is encrypted

Server security

When Hydron provisions a server, it automatically applies security best practices:

Best practices

Account security

• Use a strong, unique password — At least 12 characters with mixed case, numbers, and symbols
• Enable 2FA — Adds significant protection against unauthorized access
• Use OAuth — Sign in with Google or GitHub for additional security
• Review sessions regularly — Sign out of devices you don't recognize
• Don't share credentials — Each team member should have their own account

Application security

• Use environment variables — Never hardcode secrets in your code
• Rotate secrets periodically — Change API keys and passwords regularly
• Limit SSH access — Only allow SSH from known IP addresses
• Keep dependencies updated — Regularly update your application dependencies
• Monitor logs — Check deployment and server logs for suspicious activity

Infrastructure security

• Don't expose unnecessary ports — Only expose ports that need public access
• Use internal networking — Services should communicate via internal networks, not public IPs
• Back up your data — Regularly back up databases and important data
• Monitor server resources — Unusual CPU or network usage may indicate a security issue