This article covers where The One Stack runs and how we protect the secrets the platform uses. We deliberately don't publish component-level architecture, such as database or service names. It doesn't help you assess risk, and it would help an attacker map the platform.
Hosting
The One Stack's production platform, including its databases, runs on dedicated OVHcloud infrastructure.
Secrets and keys
We use two key-management services, each for a specific job:
- OVHcloud Key Management Service (OKMS) holds platform secrets that have been migrated to our OVH environment. Not every platform secret has been migrated, so we don't describe OKMS as holding all of them.
- Azure Key Vault holds the keys that stay there by design.
We don't claim that every secret lives in one system or that we've fully moved off Azure Key Vault.
Public website
Our public marketing website (theonestack.com) uses Cloudflare for DNS, content delivery, and web application firewall services. That statement covers the marketing website only.
What we don't publish yet
We don't publish hosting regions, encryption specifications, backup and disaster-recovery objectives, or uptime figures until we can evidence them on the current platform. For live availability, see status.theonestack.com. For the full list, see What we don't claim today.
This article describes The One Stack's practices as of the "last reviewed" date below. It is provided for general information only. It is not a contract, warranty, certification, or guarantee of any security outcome, and it does not change the terms of any agreement between you and The One Stack. Our practices may change over time. Last reviewed: 2026-10-28.