Security at GeoRevers
We sit in the path of your traffic, so security isn't a feature — it's the product. Here's how we protect data, infrastructure and your visitors.
Data in transit and at rest
All visitor and dashboard traffic is encrypted with TLS. We terminate TLS to route, but never store request or response bodies — only short-lived metadata (IP, status, path, latency) for up to 30 days, configurable per account.
Provider credentials and integration secrets are encrypted at rest with AES-GCM before they ever touch the database. Plaintext secrets are never logged.
Infrastructure isolation
- The control plane, edge nodes and authoritative services run as separate, least-privilege systems.
- Edge nodes hold only the configuration and certificates they need to serve traffic — not your account or billing data.
- Origins are reached over per-site, scoped routes; we never expose your origin address publicly.
Certificates
TLS certificates are issued automatically via Let's Encrypt and renewed before expiry. The certificate cache is shared securely across the edge so failover never drops HTTPS. Bring-your-own-certificate is available on Business and Enterprise.
Resilience and abuse
We hold reserve IP space across multiple ASNs, run canary probes inside restricted networks, and auto-rotate addresses when availability drops. We refuse domains on official block-lists and reject phishing, malware and CSAM.
Account security
Passwords are hashed with bcrypt — our database never sees plaintext. You can review and revoke active sessions from the dashboard at any time, and admin actions are recorded in an audit log.
Responsible disclosure
Found a vulnerability? Email security@georevers.com. We acknowledge reports promptly, work with you on a fix, and credit researchers who report in good faith. Please do not test against other customers' domains.