Trust & Security
How MarQi Cloud protects customer data
Short answer: MarQi Cloud runs its platform from one US data center, Zone1 in Alpharetta, Georgia, operated with our facility partner Digital Ignition. Our Data Processing Addendum sets out the security measures we maintain. We do not hold compliance certifications such as SOC 2, ISO 27001, HIPAA, PCI DSS or FedRAMP. The platform supplies infrastructure controls; your organization evidences its own compliance.
Compliance: what we do and do not claim
- No compliance certifications. MarQi Cloud does not claim SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP or similar certifications or attestations.
- Shared responsibility. We operate the infrastructure and its controls. Compliance for the workloads you run on it is yours to evidence. Our managed services can take on day-to-day operation, but they do not transfer that obligation.
- Audits of our DPA commitments. Under our Data Processing Addendum, we make available the information reasonably necessary to demonstrate compliance with the DPA and contribute to audits conducted by you or an auditor you mandate, on reasonable notice and subject to confidentiality.
Where your data lives
- One location today. Customer workloads run in Zone1, 190 Bluegrass Valley Pkwy, Alpharetta, GA 30005. Zone2 has been announced and is not yet live.
- United States. Our infrastructure operates from the United States. If you serve users outside the US, storing their data here is an international transfer under their local laws. See our Privacy Policy and DPA.
The facility
Zone1 is operated with our facility partner Digital Ignition, which lists the site’s protections as biometric access controls, N+1 redundancy, Liebert-assisted data center cooling, power generators and ISP providers (source: Digital Ignition data center). Figures such as rack power density, UPS topology or a Tier classification are not published here; ask for them with a colocation quote.
Security measures from our DPA
| Measure | What it means in practice |
|---|---|
| Production access limited to the engineers who require it | Only the engineers who need production access have it |
| Authentication and logging of administrative access | Administrative access requires authentication and is logged |
| Replication of customer volumes across separate nodes | Every block volume is kept as three copies on separate nodes |
| Continuous platform monitoring by our NOC | Hosts, storage and network are watched 24/7 (status and monitoring) |
| Encryption of inter-zone traffic in transit | Applies to traffic between zones once Zone2 is live |
Network isolation
- Every account gets its own isolated VPC. Instances talk to each other over private addressing, and nothing is reachable from outside unless you publish it deliberately (networking and VPN).
- You reach private resources over a WireGuard tunnel rather than an exposed public port. WireGuard is included with every plan.
- Virtual machines run on KVM, which isolates each VM at the hypervisor level.
Backups and data protection
- Replication is not backup. Triple replication protects against disk and host failure; it does not protect against deletion, corruption or a mistake in your own application.
- Snapshots and backups are included with every plan (snapshots and backups), and backup job health is monitored by the same NOC.
- Backups are a shared responsibility, as our Terms of Service set out: we replicate volumes and include snapshots and backups in every plan, and you decide what to protect and how often.
Incidents and notification
- Personal data breaches: we notify you without undue delay after becoming aware of a breach affecting personal data we process for you, with the information reasonably available to us, so that you can meet your own notification obligations (DPA).
- Platform risk: where activity presents an immediate risk to the platform or other customers, we may suspend the affected resource first and notify you immediately afterwards (Acceptable Use Policy).
- Maintenance: we give advance notice of planned maintenance and schedule disruptive work outside normal business hours where the work permits it (SLA).
Subprocessors
We engage subprocessors only where necessary to deliver the service, hold them to data protection obligations no less protective than our DPA, remain responsible for their performance, and inform you of any intended addition or replacement with a reasonable opportunity to object.
When you leave
On termination you may retrieve your data during a reasonable transition window, after which we delete it in line with our retention practices, except where storage is required by law. Because the platform runs standard open source components and machine images, retrieval does not depend on a proprietary export tool, and there are no egress fees on moving it out.
Reporting a vulnerability
If you find a vulnerability in our platform, report it to support@marqi.cloud rather than exploiting it. Authorised security testing of systems you own is permitted; tell us in advance so our monitoring does not treat it as a live incident (Acceptable Use Policy).
All legal documents
Terms of Service, Acceptable Use Policy, SLA, Privacy Policy, Cookie Policy and DPA are collected on the legal page.
Frequently asked questions
Does MarQi Cloud have SOC 2 or ISO 27001?
No. MarQi Cloud does not claim SOC 2, ISO 27001 or any other compliance certification. Our DPA sets out the security measures we maintain and how we support your audits.
Can I run HIPAA or PCI workloads on MarQi Cloud?
The platform supplies infrastructure controls such as isolated VPCs, replication and monitoring, but MarQi Cloud does not certify workloads. Your organization remains responsible for evidencing its own compliance.
Where is my data stored?
In Zone1, MarQi Cloud’s data center at 190 Bluegrass Valley Pkwy, Alpharetta, Georgia, in the United States.
How do I report a security issue?
Email support@marqi.cloud. For anything time-critical, call +1 770-369-9321; the team operates 24/7/365.