Security

Where your data lives

One server at OVHcloud in Singapore runs the database, the API and this web app. Your account, your jobs' results and every published score are in that database.

Your bench keeps a job's files (trajectories, logs and the rest) in Cloudflare R2, in a bucket placed in Asia-Pacific. The site opens a file for you with a link that works for 15 minutes, after it checks that the job is yours.

Subprocessors lists every provider that handles your data.

How traffic reaches the site

Cloudflare answers for nodeq.tech and terminates TLS. Every page and API answer is HTTPS only, and the site tells browsers to keep to HTTPS for a year (HSTS).

The server accepts no connection from the internet: its firewall refuses them, and Cloudflare reaches it through an encrypted tunnel that the server opens.

Cloudflare caches the public pages and API reads that every visitor sees alike, so a new score can take a minute or two to show. What you read while signed in is never cached there.

Maintainers reach the server only over a private network, with SSH keys. Password sign-in and root sign-in are off.

Encryption and secrets

• Backups are encrypted on the server, with AES-256, before they leave it.
• Model keys saved before the site stopped taking them are stored encrypted, and never shown back.
• API tokens are shown once. We keep only a SHA-256 hash of each, so a copy of the database can't be used to sign in with one.
• We don't add encryption of our own to the server's disk or to the job files in R2.

Backups

The database is backed up with pgBackRest: a full backup every Sunday, a differential backup every other day, and its changes archived continuously, at least every 15 minutes.

The server's job folder, where an upload waits until its files are in R2, is backed up every day with restic.

Both go to R2 buckets of their own, encrypted. We keep each backup until we remove it by hand, so deleted data stays in the backups until then.

Job files in R2 are not backed up. The privacy notice says how long Your bench shows them, and files leave R2 only when we purge them after a review. Results stay in the database.

What stays private

A job you upload is yours: only you can open it on Your bench, apart from maintainers handling an abuse report or support request, and every such access is recorded.

A board shows a published run's score, entry name, agent configuration and per-task results. The run's logs and files stay on Your bench, and so do its trajectories unless you make them public.

Before anything is stored, an upload's files have your saved keys, the site's own API and run tokens, and values in common key formats (Anthropic, OpenAI, Google, GitHub, Hugging Face, Slack and AWS) replaced with [REDACTED]. A secret in another format can get through, so keep secrets out of your agent's output. How redaction works.

Signing in and model keys

You sign in with GitHub. We ask only for your public profile, and we don't keep GitHub's token. The session cookie is signed and lasts 14 days, or until you sign out.

The site takes no model keys. A run on your machine reads the key from your own shell, and the key goes only to your model provider.

Report a vulnerability

Email hello@nodeq.tech, and don't post it in public first. Don't test against other people's runs, keys or data. Our security.txt gives the same address.