Security & reliability
Security is part of how we operate.
We configure, monitor and maintain Cirro’s infrastructure ourselves. Protecting our systems and keeping our validator reliable are ongoing responsibilities, supported by careful maintenance, restricted access and preparation for unexpected events.
Monitoring & response
We monitor validator performance and infrastructure health to identify interruptions, unusual behaviour and emerging issues. Alerts help us investigate problems and prioritise action when performance or availability is affected.
Updates & patching
We keep validator software and operating systems maintained, following relevant releases and security advisories. Updates are assessed for urgency and operational impact, with routine maintenance planned to limit disruption and critical vulnerabilities prioritised.
Access & permissions
Administrative access is restricted to authorised operators. Our approach centres on strong authentication, limited privileges and separation between routine validator operation and system administration.
Access and credentials are reviewed as operational needs change.
Network protection
We limit network exposure to the services required for operation and administration. Firewall rules and a minimal software footprint help reduce unnecessary entry points.
Validator infrastructure is kept focused on its operational role, with unrelated workloads separated from it.
Resilience & recovery
Our main validator operates in Hong Kong, with backup infrastructure in Frankfurt. This geographic separation supports our approach to resilience and recovery.
We maintain procedures for restoring operation and review them as our infrastructure changes. Availability depends on our own systems, hosting providers and the wider Solana network.
Key management
We restrict access to validator keys and operational credentials, keeping sensitive material out of public repositories, website assets and routine logs.
Recovery arrangements must preserve that protection while allowing authorised operators to restore service when needed.
Data protection
We limit the data we collect to what is needed to operate and support our services. We do not sell personal data or share it with third parties for their own marketing purposes.
We restrict access to authorised personnel and retain data only for as long as needed for its intended purpose or to meet legal obligations.
Continuous improvement
Security is an ongoing process. We review our practices as software, infrastructure and threats evolve, using operational experience to identify where controls and procedures can improve.
Your wallet stays yours
Transactions initiated through Cirro’s staking interface require approval in your wallet. Cirro’s server does not retain your private wallet keys.
We will never ask you to share your seed phrase or private key. Check that you are using cirro22.com, and review transaction details in your wallet before approving them.
Report a security concern
If you believe you have found a vulnerability affecting Cirro, please contact [email protected] privately.
Include the affected page or service, a description of the issue and enough information for us to reproduce it safely.
We appreciate reports that help us protect our users and improve our systems.