Data & access security

Your machine, exclusively.
Clear security boundaries.

GNUMac provides a dedicated physical Mac mini, not a virtual machine. We prepare the machine before delivery, keep it isolated throughout your rental and erase its data after it is returned. You’re responsible for your backups, access credentials and software updates.

Check your project’s data handling requirements before moving code, assets or build credentials to the machine.

Isolation

One rental, one dedicated physical machine.

Isolation starts with exclusive access to the hardware. During your rental, the machine isn’t assigned to another customer or split between users through virtualization.

Dedicated CPU and memory

You use the processor and memory in your rented machine. Other customers’ builds, simulators and inference workloads won’t run on it or compete for its resources.

Your own concurrent workloads still use the machine’s resources, so plan for your workload.

Dedicated system and data disks

The system disk and any additional SSD configured for your machine are for your use alone, not shared workspaces. Store project code, caches and model files according to their purpose.

An additional SSD gives you more capacity; it isn’t a separate backup.

You manage access on the machine

Both the macOS desktop and command line are available. If your team shares a runner or development account on the same machine, you’re responsible for managing user accounts, directory permissions and execution rights.

Physical isolation doesn’t replace access controls within your team.

Before delivery

Start with a freshly installed system.

Your rental doesn’t begin with another user’s session handed over to you. We reinstall and initialise the system before starting the delivery process for your rental.

  1. Reinstall and initialise

    We reinstall the operating system and complete the initial setup, ensuring the machine has no previous customer’s projects, account data or working directories.

  2. Access through the console

    Sign in to the console to get the connection details and credentials for your instance. Check the instance, node and order details. Machine passwords aren’t available on public pages.

  3. Check the machine when you connect

    Check the system and mounted disks first, then change the password and add your own SSH public key. If you find files that aren’t yours, stop writing to the disk and open a ticket.

Data erasure after return

When your rental ends, we erase both the system disk and additional SSD.

Data erasure is part of the return process, not a backup service. Export and verify your data, then revoke access before your rental ends. Don’t expect to recover data from a returned machine.

Before returning the machine

  • Export your code, build artifacts, assets and model configuration. Check that the files are readable from another storage location.
  • Remove the machine’s runner from your CI platform, and revoke deployment keys, repository tokens and build service authorisations.
  • Check both the system disk and additional SSD so you don’t miss essential files outside your project directory and caches.

Deleting a token file from the machine doesn’t revoke the token with its issuer.

After you return the machine

  • Your rental ends and the machine enters the disk erasure and reinitialisation process.
  • We erase the system disk and reinstall the operating system. Any additional SSD configured for the machine is included in the erasure process.
  • After checking the environment, we prepare the machine for its next delivery without carrying over your working environment.

If you need proof of erasure or have specific compliance requirements, check with us before ordering.

Access control

Get credentials through the console; use keys for day-to-day access.

Your console account and machine accounts are separate layers of access. Securing one doesn’t replace managing passwords, permissions and keys for the other.

Set up your own access

Change the machine password after your first connection and add SSH public keys as needed. Each team member should use their own key. Remove a member’s key when they leave instead of continuing to share a team private key.

Enable only the connection methods your workflow needs. Check remote desktop and SSH access separately, and never paste connection details into public repositories or build logs.

Keep private keys on trusted devices; only install public keys on the machine.

Manage credentials and incidents in the console

Machine credentials are provided only through the console after you sign in. Don’t send passwords, private keys or complete connection credentials in pre-sales emails. Redact sensitive details from tickets too.

If you suspect credentials have been exposed, change the relevant passwords, remove unknown public keys and revoke external tokens first. Then provide your order number, instance details and the time period when the issue occurred.

Sign in to manage your instance
Payment security

Payments and machine credentials are kept separate.

All orders are settled in US dollars (USD). We support only the two payment methods below. The payment options available at checkout are determined by the response from the backend.

Visa / Mastercard / Amex

Card payments are processed by Stripe. GNUMac doesn’t store full card numbers. Pay through checkout; don’t send full card details or the card security code by email or in a ticket.

For billing enquiries, your order number and payment record are enough.

USDT-TRC20

We verify payments against on-chain records. Before transferring, check the network, recipient address and amount shown for your order. If you need help, send your order number and transaction hash—never your wallet’s private key or recovery phrase.

Always follow the payment details shown on your current order page.

Your responsibilities

Make backups, credentials and updates part of your routine.

A dedicated physical machine isolates your resources from other customers, but it can’t prevent accidental deletion, malicious dependencies or misconfigured permissions within your project.

  • Keep separate backups. Store important code, configuration and irreplaceable build artifacts somewhere other than the machine. Test restores regularly; don’t rely only on a backup job reporting success.
  • Grant only the access needed. Scope repository tokens to each project instead of putting personal, broadly privileged credentials in the runner environment. Redact logs, screenshots and ticket attachments.
  • Install updates promptly. Keep up with security updates for macOS, remote access clients and build dependencies. Back up before upgrading, and check compatibility with Xcode, plugins and your existing pipelines.
  • Document environment changes. Record dependency versions, build commands and configuration steps. After a system reinstall, you should be able to rebuild the environment from your notes rather than rely on a one-off manual setup.
  • Check where automation comes from. CI jobs triggered by external contributions shouldn’t have release permissions by default. Check the source and contents before running unknown scripts, installing dependencies or importing model tools.
  • Revoke access before ending your rental. Export your data, remove the runner, revoke tokens and remove deployment authorisations. Check these separately from returning the machine so external service access isn’t overlooked.
Report a security issue

Contain the impact first, then send us the details.

For an issue with an instance on an existing order, sign in to the console and open a ticket. If you can’t sign in, have found a website security issue or need to check security requirements before renting, email us at support@gnumac.com.

  1. Include details we can use to locate the issue

    Provide your order number or instance ID, the affected feature, and the time and time zone. Tell us whether the issue is ongoing or whether you’ve contained it by changing passwords, revoking tokens or taking similar steps.

  2. Share the shortest steps to reproduce it

    Describe what you did, in order, and the expected and actual results. Include redacted log excerpts or screenshots. Don’t send passwords, private keys, full card numbers or unrelated business data.

  3. Keep the conversation in one channel

    Our team will assess the scope and may ask for more information. We’ll share updates in the original ticket or email thread. Keep follow-ups in the same conversation where possible so the full context stays together.

Know the boundaries before moving your workflow.

Exclusive use doesn’t replace backups, and erasure doesn’t revoke access. If you have specific data handling requirements, confirm them by email before renting.