Skip to main content

Trust & Operations

This page separates current controls from Beta behavior and roadmap work. ColabHive is an early-stage production platform; it does not claim enterprise certification where evidence has not been published.

Last reviewed: 17 August 2026
Public summary: colabhive.com/trust.html

Security posture​

Available today:

  • TLS for public API and web traffic;
  • hashed API-key storage, expiration and revocation;
  • account-scoped models, datasets, endpoints and artifacts;
  • versioned runtime images, request correlation IDs and model lineage;
  • private-cluster placement by default, without automatic placement on shared capacity.

Not a published guarantee today:

  • granular API-key scope enforcement;
  • project/environment RBAC and service accounts;
  • workload mTLS and tenant-specific KMS;
  • third-party pentest evidence, SOC 2 or ISO 27001.

Report a security issue to security@colabhive.com.

Privacy and deployment boundary​

Private Cluster is the default production tier. Cloud Burst is Beta and Share Hive is in development. Per-workload residency and provider/region restrictions are not yet enforced as a general public contract.

Retention, deletion timing, subprocessors and DPA requirements are deployment-specific until a public enterprise policy is published. See the Privacy Notice and Private Agentic Infrastructure.

Operational status​

status.colabhive.com is currently a health-entry and maturity page, not a historical uptime dashboard. Public component SLOs, incident history and availability percentages have not been published.

Live, read-only checks:

Service levels​

There is no general public SLA today. Availability, latency, throughput, recovery and support targets apply only when written into a pilot or customer agreement. Product maturity labels are not substitutes for an SLA:

LabelMeaning
ProductionRunning real workloads today
BetaLive with deliberate operational limits
In developmentBeing built; not a shipped guarantee
ArchitectureDesign direction; not available

Public API-contract limits​

The API is versioned and publishes OpenAPI 3.1. Runtime errors use the stable error.code/message/details/request_id envelope. The generated OpenAPI still describes validation errors with FastAPI's legacy schema and leaves many success responses untyped. API-key scopes are stored but are not yet enforced granularly. These limitations are documented in the API Reference.