Skip to content
Security assessments

Security assessments and testing

Customers are responsible for assessing the security of their own workloads on Thalassa Cloud — applications, virtual machines, Kubernetes clusters, and network configurations within their organisation. Under the shared responsibility model, these tests fall on your side of the boundary.

Thalassa Cloud welcomes structured security testing and is available to assist with planning, coordination, and disaster recovery exercises. This page describes what is permitted, what requires advance notification, and what is not allowed.

Before you begin

Advance notification is required before any security test that could be detected as suspicious activity — including penetration tests, vulnerability scans, authentication brute-force attempts, or failover exercises that generate unusual traffic patterns.

Contact Thalassa Cloud support with the following information before your test window opens:

Required informationDetail
OrganisationYour Thalassa Cloud organisation name and account contact
Test contactName, email, and phone number of the person responsible during the test window — reachable if our security team needs to reach you
ScopeResources under test: VPC IDs, IP ranges, hostnames, Kubernetes cluster names, API endpoints, and services involved
Source IPsPublic IP addresses or CIDR ranges from which testing traffic will originate — including any VPN exit nodes or third-party pentest provider infrastructure
Test windowPlanned start and end date/time (with timezone)
Test typePenetration test, vulnerability scan, red team exercise, disaster recovery test, or other — with a brief description of techniques planned
Third partiesName of external pentest firm if applicable

Providing complete source IPs and a reachable contact allows our operations and security teams to distinguish your authorised test from genuine threats. Tests conducted without notification may trigger incident response and could be blocked.

Permitted scope

Security tests may target resources within your organisation’s tenancy that you own and operate:

In scopeExamples
Your VPCs and subnetsNetwork scanning, firewall rule validation, routing tests
Your compute instancesVM vulnerability assessment, OS-level pentesting, configuration review
Your Kubernetes clustersApplication pentesting, API server access tests (from authorised sources), workload exploitation attempts within your cluster
Your managed servicesDatabase connection security, DNS record validation, application-layer testing against your endpoints
Your load balancers and public endpointsWeb application pentesting, TLS configuration review, authentication testing against your applications

Tests must stay within resources allocated to your organisation. You may not probe, scan, or attempt to access resources belonging to other customers.

Prohibited activities

The following activities are not permitted under any circumstances, even with advance notification:

ProhibitedReason
Denial-of-service (DoS) and distributed denial-of-service (DDoS) testsHigh-volume traffic attacks against any target — including your own resources — can affect shared platform infrastructure and other customers
Traffic floods and resource exhaustionTests designed to generate excessive load, saturate bandwidth, or exhaust compute, storage, or API capacity
Quota and rate limit bypass attemptsProbing or exploiting Thalassa Cloud platform limits, API rate limits, or tenant quotas
Testing other customers’ resourcesAny access attempt against organisations, VPCs, or services you do not own
Platform and control plane testingProbing Thalassa Cloud APIs, management interfaces, hypervisors, storage backends, or internal infrastructure outside your tenancy
Physical and social engineeringData center access attempts, social engineering of Thalassa Cloud staff, or phishing of platform operators
Malware distributionDeploying malware or command-and-control infrastructure that could affect the broader platform

If your assessment plan includes activities that might resemble the above — for example, load testing at scale — contact support before scheduling to discuss alternatives. We can often accommodate legitimate performance or resilience testing through coordinated windows and controlled environments.

Thalassa Cloud assistance

We are available to help you run security and resilience exercises successfully:

ServiceHow we can help
Security test coordinationReview your test plan, confirm scope boundaries, and ensure source IPs are recognised during the test window
Disaster recovery testingPlan failover exercises across availability zones, validate backup and restore procedures, and coordinate timing to minimise risk
Business continuity exercisesSupport structured tests of your recovery time objectives (RTO) and recovery point objectives (RPO) on the platform
Post-test reviewDiscuss findings that relate to platform behaviour or shared infrastructure, and clarify shared responsibility boundaries

Contact Thalassa Cloud support to schedule a planning call. For complex exercises — multi-zone failover, large-scale restore tests, or assessments spanning multiple services — early engagement (two weeks or more before the test date) is recommended.

Self-service audit and monitoring

You do not need advance approval to review your own operational and audit data:

  • Audit logs — Review and export organisation audit logs for compliance review and access analysis. See Audit logs and Exporting audit logs.
  • IAM reviews — Audit user, team, and service account permissions via the console or API. See IAM and RBAC roles.
  • Configuration review — Inspect security groups, firewall rules, KMS key policies, and Secrets Manager access policies through standard platform tooling.

These activities are part of normal operations and do not require notification.

Reporting security issues

If you discover a vulnerability in Thalassa Cloud platform infrastructure — not in your own configuration — report it to Thalassa Cloud support with sufficient detail for our security team to investigate. Do not publicly disclose platform vulnerabilities before we have had reasonable time to remediate.

Related documentation