Rotated by the platform
- Out-of-band management credentials, rotated automatically on a 30 day cycle.
- Platform internal service credentials, rotated on a 30 day cycle.
- Facility access credentials, rotated on personnel change and reviewed quarterly.
- Memory encryption keys, generated per secure server launch and never persisted.
Memory encryption keys cannot be recovered by anyone, including ServLogi. This is intentional, and as a result there is no key escrow process.
Rotated by you
- Client Portal API secrets. There is no enforced expiry, but rotation every 90 days or less is expected and reviewed during assessment.
- SSH keys for server operators. Rotate whenever personnel change, without exception.
- Any application-level keys or certificates, on your own schedule.
- Interconnect pre-shared keys, coordinated with us on a 180 day cycle.
Rotating without downtime
For API secrets and interconnect keys, both the old and new values remain valid during a transition period. Create the replacement, deploy it, confirm that traffic is using it, and then revoke the old value. Revoking the old value first is a common cause of avoidable outages.
For SSH keys, add the new key to the server before removing the old one, and confirm you can sign in with the new key from a separate session before closing your current session.