Snapshot 71858
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Security Program whitepaper published
Trust Center
Start your security review
View & download sensitive information
Ask for information
Overview
Welcome to Daytona's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation.
Compliance
GDPR
HIPAA
SOC 2
ISO/IEC 27001
SOC 2 Type 1
SOC 2 Type 2
Documents
Featured Documents
DOCUMENTSSecurity Program Whitepaper
LEGALCyber Insurance
REPORTSPentest Report
COMPLIANCESOC 2 Type 1
COMPLIANCESOC 2 Type 2
COMPLIANCEHIPAA
Risk Profile
Data Access LevelPublic
Third Party DependenceYes
HostingMajor Cloud Provider
Product Security
Audit Logging
Data Security
Multi-Factor Authentication
View more
Reports
Data Flow Diagram (DFD)
Network Diagram
Pentest Report
Self-Assessments
CAIQ Lite
Data Security
Access Monitoring
Data Backups
Encryption-at-rest
View more
App Security
Application Penetration Testing
Code Analysis
Credential Management
View more
AI
AI Overview
AI Feature
AI Security
View more
ESG
Anti-Competitive Practices
Anti-Modern Slavery
Code of Ethics
View more
Legal
Subprocessors
Customer Audit Rights
Cyber Insurance
View more
Data Privacy
Cookies
Data Breach Notifications
Data Privacy Officer
View more
Access Control
Access Log Management
Automated Account Management
Bring Your Own Device (BYOD)
View more
Infrastructure
Status Monitoring
Amazon Web Services
Anti-DDoS
View more
Endpoint Security
Anti-Malware
Disk Encryption
Mobile Device Management
View more
Network Security
Bot Detection
Threat Detection
Distributed Denial of Service Protection (Anti-DDoS)
View more
Corporate Security
Asset Management Practices
Email Protection
Incident Response
View more
Policies
Acceptable Use Policy
Access Control Policy
Anti-Malicious Software Policy
View more
Incident Response
Designated Response Personnel
Incident Reporting Process
Pager Service
Risk Management
Risk Assessments
Supply Chain Risk Management
Asset Management
Asset Inventories (Hardware/Software)
Asset Tracking
Secure Asset Disposal
BC/DR
Business Continuity Management System (BCMS)
Business Continuity Plan (BCP)
Contingency Plan Testing/Lessons Learned
View more
Training
Employee Privacy Training
Phishing Training
Secure Development Training
View more
Change Management
Change Restrictions
Changes Notification & Verification
Configuration Management Program
View more
Continuous Monitoring
Automated Alert Response
Automated Compliance Monitoring
Event & Audit Log Management
View more
Trust Center Updates
Security Program whitepaper published
General
Title: Security Program whitepaper published
Category: Documentation
Status: Published
Daytona has published its Security Program whitepaper, version 1.0 (October 2026). The 18-page document covers sandbox isolation architecture, our threat model, network and egress controls, secrets handling, data residency, identity and access, vulnerability management SLAs, incident response, business continuity, shared responsibility and current certifications. It is reviewed at least annually and new versions will be announced here.
What this means for you
No action required. The document is public and can be downloaded from the Documents section of this trust center without an access request. Use it as the starting point for a security review; the SOC 2 reports, penetration test summary and CAIQ Lite self-assessment remain available on request.
More
Download: https://trust.daytona.io/?itemUid=71d7b6d9-19d2-4c3d-8210-6074745070ac
Questions: security@daytona.io
SOC 2 Type II report issued
Compliance
Title: SOC 2 Type II report issued
Category: Compliance Update
Status: Issued
Daytona's SOC 2 Type II examination is complete. Insight Assurance issued the report
on July 28, 2026 with an unqualified opinion covering the period December 16, 2025
through March 15, 2026, across the Security, Availability, and Confidentiality Trust
Services Criteria.
Type I, which we held previously, assessed whether our controls were suitably
designed at a single point in time. Type II tests whether those controls operated
effectively across a defined period. This report covers the control environment for
the Daytona AI Runtime Platform, including access control, change management,
logging and monitoring, incident response, and vendor management.
What this means for you
No action is required. Customers and prospects can request the full report through
this trust center, where it sits alongside our SOC 2 Type I report and HIPAA
attestation. Existing agreements and BAAs are unaffected.
More
Request the report: https://trust.daytona.io/
Questions: security@daytona.io
CVE-2026-31431 ("Copy Fail")
Vulnerabilities
Title: CVE-2026-31431 ("Copy Fail") — Linux kernel page cache write primitive, fully remediated
Category: Security Advisory
Severity: High
Status: Resolved
Notify subscribers: Yes
On April 29, 2026, a Linux kernel vulnerability (CVE-2026-31431, "Copy Fail") was publicly disclosed in the authencesn AEAD cryptographic template, reachable from userspace via the AF_ALG socket interface (algif_aead). The flaw allows an unprivileged process to perform a deterministic, controlled write into the kernel page cache without modifying anything on disk. On multi-tenant hosts, this creates a theoretical path for one sandbox to corrupt cached file content visible to co-tenant sandboxes. All Daytona infrastructure was fully remediated within 12 hours of disclosure. We have no evidence of exploitation, and the Sysbox runtime isolation boundary was not breached.
Am I affected?
No action is required. Daytona infrastructure is fully remediated across all regions.
Yes, your environment was in scope for the mitigation if you were running sandboxes on Daytona between April 29 and April 30, 2026 — but remediation was applied automatically without customer action.
What we did
Patched the Linux kernel where available.
Blacklisted the algif_aead module on hosts as an immediate, defense-in-depth mitigation.
Rotated all API credentials associated with runner infrastructure as a precaution.
Paused all new user and organization signups during the active response window; signups have since resumed.
More
Full write-up: https://www.daytona.io/dotfiles/updates/security-update-cve-2026-31431-copy-fail
Questions: security@daytona.io
API credential exposure
Vulnerabilities
Title: API credential exposure in sandboxes — patched, rotation required if affected
Category: Security Advisory
Severity: High
Status: Resolved
Notify subscribers: Yes
On April 9, 2026, we patched a vulnerability that allowed API credentials passed via the Daytona CLI or SDK to be read from sandbox memory by anyone with shell access on the same sandbox. The fix was deployed and verified in every region the same day in under five hours from disclosure to full remediation. We have no evidence of exploitation.
Am I affected?
Yes, if you used the CLI or SDK to authenticate to a sandbox launched from the default snapshot (or a custom snapshot that still had sudo) at any point before April 9, 2026, 20:44 UTC.
No, if your sandboxes only run on custom snapshots without sudo or root.
What to do
If you're in scope, rotate any API keys, service account keys, and CI/CD credentials that were used in the affected window. Rotation lives in the dashboard under Settings → API Keys.
Then review your audit logs for that same window for any sandbox operations, key usage, or admin actions you can't attribute to a known source. If anything looks off, email security@daytona.io.
A successful exploit would look identical to normal API traffic in our logs, so we can't prove a clean negative. Please treat rotation as required, not precautionary.
More
Full write-up: Security Advisory: API Credential Exposure in Sandboxes
Questions: security@daytona.io