Security

Signing in

• Gysga uses one-time codes sent to your email instead of passwords. A code is valid for 10 minutes, works once and is locked after 5 wrong attempts.
• Your dashboard session lives in a secure, HttpOnly cookie that scripts on the page cannot read; all state-changing requests are checked against cross-site forgery.
• Signing out ends the session on the server immediately.

Coming soon

Two-factor authentication (authenticator apps and passkeys) for sensitive actions.

API keys and SSH keys

• API keys are shown once and stored only as a hash. Revoke a key immediately if it leaks. Each key has your account’s full rights over servers and balance — keep it on servers, never in a browser or mobile app.
• SSH keys: only the public part is uploaded. The gateway accepts ed25519, ECDSA and RSA ≥ 2048.
• Verify the SSH gateway’s host key fingerprint on the first connection (shown in the dashboard).
• When you call your model through the proxy, your Gysga key is removed before the request reaches the container.

Your servers

• Each server runs in its own container with its own GPUs, limited CPU, memory and processes. Containers of different renters cannot reach each other, the host’s local network or the host itself.
• Host machines never expose ports; you connect through the Gysga gateway and an encrypted tunnel.
• Web interfaces (Jupyter, ComfyUI, …) are not published on the internet: you open them through SSH port forwarding, or call them through the authenticated API proxy.

Servers run on hosts’ machines

Hosts are independent owners of the hardware and have administrator access to their machines. Container isolation protects your server from other renters, but it cannot hide your data from the owner of the machine. Don’t put secrets you can’t afford to expose (production credentials, private keys, sensitive personal data) on a rented server. Prefer short-lived, limited tokens (for example a read-only Hugging Face token) and keep your own backups.

Deposits

Deposit addresses are derived from an HD wallet. The platform’s servers only know how to derive addresses and hold no private keys.

Gysga will never ask you for a seed phrase, a private key or a password, by email, chat or anywhere else.

For hosts

See Rent out your GPU → Security: unprivileged containers, no inbound ports, network isolation.

Phishing

The only official domains are gysga.com and its subdomains (app.gysga.com, api.gysga.com, ssh.gysga.com, docs.gysga.com, get.gysga.com, status.gysga.com). Check the address bar before entering a login code, and only install the host agent from https://get.gysga.com.