Security
Security
You are trusting us with credentials that can rewrite your DNS. This page says exactly how they are handled, and what you can do so you do not have to trust us at all.
Current status
From the platform, 2026-09-25.
- Key wrappers
- OCI Vault, Local key (development and emergency only)
- Storage replicas
- 0 replicas
- Last restore drill
- Published once the platform is live
- Probe uptime, 30 days
- n/a
- 1 probe regions
Deterministic by design
No model in the sync path: every change is a diff you can read, replay and audit.
- No AI or machine-learning component writes a record. Syncing compares the zone with each provider, applies only the difference and reads it back; the same zone and the same provider state always give the same changes.
- Every change to a zone is a diff in its journal, with its serial and author, next to the audit entry that says who made it and from where.
- If an insight is ever produced by a model, for example an explanation of a finding, it is labelled as such and never acts: it cannot write a record or change a setting.
Provider credentials
-
Every organization has its own data key (
AES-256-GCM). Credentials are sealed with it as soon as they arrive, inside the organization’s manifest. - The data key is stored only wrapped by the platform’s key encryption keys, held in production by a KMS (AWS KMS or OCI Vault).
- Credentials are write-only: the dashboard, the API and MCP never return them. You can replace or delete them.
- Least privilege by design: two access levels per provider, with the exact policies documented. The narrower one edits one zone and nothing else.
- Revoke at the provider any time; your zones keep being served as they are.
Zone data and storage
- No database: zones, their journal, audit entries, tokens and alerts are objects in a bucket, sealed with the organization’s key. Only operational status (sync state and probe results) is stored unsealed, and it holds no secrets.
- Buckets can replicate to other clouds, with a reconciler and a documented failover switch.
- A weekly restore drill opens every sealed object in a fresh copy of the bucket, to prove the keys and the data still work together.
Access control
- Passwordless sign-in with one-time e-mail codes (stored only as a hash, valid for 10 minutes).
- Roles per organization: owner, admin, editor, viewer.
- Personal access tokens are stored as hashes, bound to one organization, with scopes, optional expiry and an IP allowlist.
- OAuth 2.1 with PKCE for MCP clients; refresh tokens rotate, and reuse revokes the whole grant.
- Organization-wide IP allowlists apply to the API and MCP.
- Every change, from the dashboard, the API, Terraform or MCP, lands in the audit log with the actor, the source and the client IP.
Keep it all in-house
On the Enterprise plan, run the data plane yourself or self-host the whole thing. Provider credentials and encryption keys then stay in your bucket, on your infrastructure.
Report a vulnerability
Write to security@redundantdns.com. Include the steps to reproduce, and please give us time to fix the issue before you publish it.
Put your zone on two providers
Start with a 30-day trial: one zone on two providers you already have, no card. Plans from $9 a month after that.