Teams and security
Updated
Wolkra lets you run your cloud as a team with organizations, projects and roles, and protects every account with two-factor sign-in, session control and an activity log. People get exactly the access they need, and you can always see who did what.
Organizations and members
An organization is the home of your team's cloud. It holds the balance, the projects and the people. Invite colleagues by email, and they sign in with their own account. No one shares a password, and removing access is one click when someone leaves.
Organization roles
| Role | Typical person | Can |
|---|---|---|
| Owner | Founder, account holder | Everything, including managing other owners |
| Admin | Lead engineer | Manage members, projects and resources |
| Billing | Finance | Manage the balance and top-ups |
| Member | Engineer | Work in the projects they are given access to |
Projects and per-project roles
Projects separate resources: production and staging, one project per customer, or one per product. Each project has its own servers, networks, firewalls, load balancers and API tokens.
Per-project roles let you go further. A contractor can work in the staging project without seeing production. An on-call engineer can have full access to production while the rest of the team only reads it.
Activity log
The activity log records actions taken in the console and through the API. When a server was resized, a firewall rule changed or a volume deleted, you can see who did it and when. That helps with troubleshooting, reviews and internal audits.
Account security
- Two-factor authentication (TOTP) with any authenticator app
- Sign in with Google for teams that already manage identities there
- Active sessions listed in your account, with the option to sign out of any of them
- Project-scoped API tokens with read-only or read/write access, optional IP allow lists and optional expiry
- Delete protection on servers to prevent accidental removal
Turn on two-factor authentication for every member, especially owners and billing users. The account security doc walks through the setup.
Security on the infrastructure side
- Firewalls are free, stateful and can be applied by label.
- Private networks keep databases and internal services off the internet.
- NAT gateways give private servers outbound access without exposing them.
- Cloudflare protects our website and console.
Privacy and data location
Servers run in our data center in Frankfurt, Germany, so the data on them stays in Germany and the EU. The privacy policy lists the processors we use: Stripe for card payments, AWS in its Frankfurt region for email, and Cloudflare in front of the website and console. For a broader look at hosting under the GDPR, read EU VPS and GDPR and the guide to GDPR hosting in Germany.
Abuse handling
Reports about abuse coming from Wolkra servers go to [email protected]. Each report becomes a case with a deadline for the customer to respond. Rules are in the Acceptable Use Policy.
Typical setups
- A small startup: one owner, a billing user for the accountant, members for each engineer, and separate production and staging projects. See SaaS startups.
- An agency: one project per client, with client contacts added only to their own project.
- A solo developer: a personal organization with two-factor sign-in and a read-only token for monitoring.
Good practice for teams
- Give every person their own account. Never share a login.
- Keep owners to a small number and protect them with two-factor authentication.
- Use separate projects for production and everything else.
- Give scripts their own API tokens with the smallest scope, and set an expiry on temporary ones.
- Review active sessions and remove members who no longer need access.
- Check the activity log after incidents and changes.
Pricing basis
Organizations, members, projects, roles, the activity log and two-factor authentication are included at no extra cost. You pay only for resources, billed by the hour from your prepaid balance.
Related pages
Bring your team
Invite your colleagues and give each one the right access from day one. Sign up for Wolkra.
Frequently asked questions
Can several people share one Wolkra account?
Yes, through an organization. Invite members, give each one a role, and share one balance and set of projects without sharing passwords.
Which roles are available?
Organizations have four roles: owner, admin, billing and member. Projects can also have their own roles, so a person can have access to one project but not another.
Does Wolkra support two-factor authentication?
Yes. You can protect your sign-in with a TOTP authenticator app, such as the ones built into common password managers.
Can I see who changed something?
Yes. The activity log records actions in your organization and projects, so you can see who created, changed or deleted a resource and when.
Can I sign in with Google?
Yes. You can sign in with your Google account instead of a separate password.
Where is my data stored?
Servers and their data run in Frankfurt, Germany. Our privacy policy explains which processors we use, such as Stripe for cards and AWS in Frankfurt for email.