Germany (Falkenstein or Nuremberg)
Finland (Helsinki)
depending on availability and/or preference

Host firewall (UFW), managed by the management platform, only allows 80/443 (web) and SSH. The database port is not reachable from outside. All traffic runs over HTTPS.

Server access only via SSH with keys; password login is disabled. Odoo access via personal user accounts with roles and rights per user; two-factor authentication available. Integrations with external systems use API keys per integration user, never personal passwords.

Gomworx administrators (SSH key)

Customer (per Odoo user through Odoo database)

SaaS platform, connected to your Hetzner server

Connects to the server with a unique SSH management key per server, never shared between servers or workspaces. Every user-initiated operation is logged in an audit trail. Details below.

Gomworx administrator account with two-factor authentication (active). Cloudpepper connects only from two fixed source IPs, which are allowlisted on the server firewall. Customers get no access by default; all changes go through Gomworx.

Gomworx administrators (2FA)

None

Cloudpepper generates a unique SSH management key for each connected server. Keys are not shared between servers or across a workspace.

There is currently no self-service rotation option in the dashboard or API, and keys are not rotated on a fixed schedule. If compromise is suspected, the affected key is removed from the server immediately and Cloudpepper support coordinates the replacement; a one-time reconnect may be required if access has already been revoked.

Cloudpepper connects from two fixed IPv4 addresses. The authoritative list is published at api.cloudpepper.io/ip-list.txt and has remained stable since January 2025; there is no formal advance-notice SLA for changes. Gomworx allowlists these addresses on port 22 and checks the list at every server setup.

Private keys are encrypted before storage in tenant-scoped backend storage and decrypted only when required for an authorised server operation. Access is restricted to the platform service and authorised Cloudpepper administrators for operational or support purposes. This is application-level encrypted storage, not HSM custody.

Workspace administrators can retrieve the audit trail in JSON. It records timestamp, user, action and affected resource for user-initiated operations; it does not record every automated SSH connection, command or scheduled job as a separate session entry. Technical and security logs are retained for up to 1 month, longer where required for an investigation. Cloudpepper support can provide an extract for a specific incident period.

Audit-log exports are taken on the day an incident is reported, not afterwards, because of the 1-month retention. Server-side SSH, sudo and firewall logs are kept for 90 days by Gomworx independently of Cloudpepper, so platform sessions remain traceable on the server itself.

United States (GitHub, Microsoft). Source code only, no business data.

Private repository, visible only to explicitly invited collaborators.

The server pulls code with a read-only deploy key; no personal credentials are stored on the server.

Gomworx (2FA)

Customer technical contact on request (read rights on own repository)

OVH datacenters, France (EU). 
Optional second target of your choice (S3 / SFTP).

Encrypted in transit (TLS) and at rest. Geographically and operationally separated from the production server.

Storage credentials exist only in the management platform, not on the Odoo server, so a compromised server cannot delete the backups.

Gomworx, via the management platform (2FA)

Customer, via optional second copy to own S3 / SFTP

Central monitor on a separate Gomworx server at Hetzner
Agent on your Odoo server

Two channels: the central monitor reads Odoo through the standard XML-RPC API with a separate read-only monitoring user and API key, and the agent on your server sends metrics and log lines outbound only (HTTPS) with a per-server token that can be revoked individually. No inbound connection, no SSH or other server access from the monitor.

Dashboard behind its own login. Each customer gets a status page with own login or access code that shows only their instance.

Gomworx (admin)

Customer (own status page)
Monitoring account (read-only API user in Odoo)

Certificate on the server; DNS at your registrar or at Gomworx

HTTPS only; Let's Encrypt certificate. The monitor alerts on SSL expiry.

DNS changes via your registrar account or via Gomworx. Optional Cloudflare Access or VPN-only access for the backoffice.

Gomworx (Certificate); Customer or Gomworx (DNS)

None