Security
Cloudflare Infrastructure
How VULK uses Cloudflare for security, performance, and data protection
Cloudflare Security Layer
VULK uses Cloudflare for edge delivery, deploy hosting, WAF/DDoS protection, R2 assets, and parts of the generated-app runtime. VULK-managed application backends store their data in a separate Hetzner-hosted PostgreSQL service through vulk-api-engine. This is separate from the main VULK database on AWS RDS.
Architecture
| Component | Service / Provider | Benefit |
|---|---|---|
| Frontend | Cloudflare Pages | Global CDN, fast loads |
| Backend API | vulk-api-engine (Bun + Hono) | Generated REST API, auth, CRUD |
| Main VULK Database | AWS RDS PostgreSQL (Frankfurt) | Accounts, Studio conversations and stored project source |
| Application Backend Database | PostgreSQL on Hetzner (Germany) | Separate project databases |
| Secrets | Encrypted Secrets Manager | Runtime environment variables |
| Files | R2 Storage | S3-compatible object storage |
| Protection | WAF + DDoS | Automatic attack mitigation |
Secrets Management
API keys and sensitive configuration are stored encrypted and injected into the runtime environment only when needed:
How It Works
- You add secrets via the VULK dashboard (Secrets Manager)
- Secrets are encrypted before storage
- Stored as runtime environment variables for the deployed app/backend
- Only the deployed runtime can access them
- Never exposed in code, logs, or responses
Security Guarantees
- Encrypted at rest — AES-256 encryption
- Encrypted in transit — TLS 1.3
- Isolated per-project — Each deployment has its own secrets
- No plain text storage — Secrets are never stored unencrypted
- Automatic rotation — Update secrets without redeploying code
Data Locations
Cloudflare automatically routes static assets and edge traffic to the nearest edge location:
- 200+ data centers worldwide
- Sub-50ms latency from most locations
- Automatic failover if any location has issues
Compliance
Cloudflare maintains certifications for:
- SOC 2 Type II
- ISO 27001
- GDPR compliance
- PCI DSS (for payment data)
What This Means for You
When you deploy with VULK:
- Your frontend and assets run at the edge - Fast for users everywhere
- Your secrets are encrypted - Never exposed
- Your data is protected - Enterprise security by default
- You don't manage servers - Cloudflare handles infrastructure