Modal logo
IntroductionCustom container images Custom containersPrivate registriesGPUs and other resources GPU accelerationReserving CPU and memoryScaling out Scaling outDicts and queuesJob processingConcurrent inputs on a single container (beta)Secrets and environment variables SecretsEnvironment variablesDeployment Managing deploymentsInvoke deployed functionsContinuous deploymentScheduling and cron jobsWeb endpoints Web endpointsStreaming endpointsWeb endpoint URLsRequest timeoutsTunnels (beta)Data sharing and storage Passing local dataVolumesMounting local files and directoriesStoring model weightsCloud bucket mounts (Beta)Network file systems (superseded)Dynamic sandboxes (beta)Reliability and robustness Failures and retriesPreemptionTimeoutsTroubleshootingSecurity and privacyIntegrations Connecting Modal to your Vercel accountOkta SSOOther topics File and project structureDeveloping and debuggingCold start performanceMemory Snapshot (beta)Modal user account setupWorkspacesEnvironmentsJupyter notebooksAsynchronous API usageGlobal variablesContainer lifecycle and parametersApps, Stubs, and entrypoints

Security and privacy at Modal

The document outlines Modal’s security and privacy commitments.

Application security (AppSec)

AppSec is the practice of building software that is secure by design, secured during development, secured with testing and review, and deployed securely.

  • We build our software using memory-safe programming languages, including Rust (for our worker runtime and storage infrastructure) and Python (for our API servers and Modal client).
  • Software dependencies are audited by Github’s Dependabot.
  • We make decisions that minimize our attack surface. Most interactions with Modal are well-described in a gRPC API, and occur through modal, our open-source command-line tool and Python client library.
  • We have automated synthetic monitoring test applications that continously check for network and application isolation within our runtime.
  • We use HTTPS for secure connections. Modal forces HTTPS for all services using TLS (SSL), including our public website and the Dashboard to ensure secure connections. Modal’s client library connects to Modal’s servers over TLS and verify TLS certificates on each connection.
  • All user data is encrypted in transit and at rest.
  • All public Modal APIs use TLS 1.3, the latest and safest version of the TLS protocol.
  • Internal code reviews are performed using a modern, PR-based development workflow (Github), and engage external penetration testing firms to assess our software security.

Corporate security (CorpSec)

CorpSec is the practice of making sure Modal employees have secure access to Modal company infrastructure, and also that exposed channels to Modal are secured. CorpSec controls are the primary concern of standards such as SOC2.

  • Access to our services and applications is gated on a SSO Identity Provider (IdP).
  • We mandata phishing-resistant multi-factor authentication (MFA) in all enrolled IdP accounts.
  • We regularly audit access to internal systems.
  • Employee laptops are protected by full disk encryption using FileVault2, and managed by Secureframe MDM.

Network and infrastructure security (InfraSec)

InfraSec is the practice of ensuring a hardened, minimal attack surface for components we deploy on our network.

  • Modal uses logging and metrics observability providers, including Datadog and Sentry.io.
  • Compute jobs at Modal are containerized and virtualized using gVisor, the sandboxing technology developed at Google and used in their Google Cloud Run and Google Kubernetes Engine cloud services.
  • We conduct annual business continuity and security incident exercises.

Vulnerability remediation

Security vulnerabilities directly affecting Modal’s systems and services will be patched or otherwise remediated within a timeframe appropriate for the severity of the vulnerability, subject to the public availability of a patch or other remediation mechanisms.

If there is a CVSS severity rating accompanying a vulnerability disclosure, we rely on that as a starting point, but may upgrade or downgrade the severity using our best judgement.

Severity timeframes

  • Critical: 24 hours
  • High: 1 week
  • Medium: 1 month
  • Low: 3 months
  • Informational: 3 months or longer

SOC 2

We have successfully completed a System and Organization Controls (SOC) 2 Type 1 audit. Contact us at security@modal.com for more details or access to the report.

PCI

Payment Card Industry Data Security Standard (PCI) is a standard that defines the security and privacy requirements for payment card processing.

Modal uses Stripe to securely process transactions and trusts their commitment to best-in-class security. We do not store personal credit card information for any of our customers. Stripe is certified as “PCI Service Provider Level 1”, which is the highest level of certification in the payments industry.

Bug bounty program

Keeping user data secure is a top priority at Modal. We welcome contributions from the security community to identify vulnerabilities in our product and disclose them to us in a responsible manner. We offer rewards ranging from $100 to $1000+ depending on the severity of the issue discovered. To participate, please send a report of the vulnerability to security@modal.com.

Data privacy

Modal will never access or use:

  • your source code.
  • the inputs or outputs to your Modal Functions.
  • any data you store in Modal, such as in Images or Volumes.

Input and output data for a function are deleted from our system once the output has been retrieved. If the output has not been retrieved after a max TTL of 24 hours the input and output are deleted automatically.

App logs and metadata are stored on Modal. Modal will not access this data unless permission is granted by the user to help with troubleshooting.

Questions?

Email us!