Altostratus

Quick start

Get from account creation to your first deployed instance in under fifteen minutes.

1. Create an account Sign up at altostratus-production.up.railway.app with a handle and recovery key. No email required. Store your recovery key somewhere secure — it is the only way to recover account access.
2. Activate your subscription Choose a plan and pay via Rudis. You'll receive a Lightning, BTC, or Monero invoice. Payment confirms instantly on Lightning; BTC confirms within one block; Monero confirms within two blocks. No card, no billing identity.
3. Connect a cloud platform Navigate to Platforms → Add Platform. Select your provider and enter your API credentials. Credentials are stored AES-256-GCM encrypted and never transmitted in plaintext.
4. Provision your first instance Go to Instances → New Instance. Select your connected platform, choose a region, configure your instance type, and deploy. Multi-region deployments follow the same flow across multiple platforms simultaneously.
5. Monitor and manage The dashboard shows real-time status across all connected platforms. Start, stop, and destroy instances from one interface. Metrics and scan data are retained per your plan tier (30, 90, or 365 days).

Altostratus

Account & identity

Altostratus accounts are pseudonymous by design. There is no email address, no phone number, and no government identity linked to your account at any point.

Handle

Your handle is your account identifier. It is not publicly visible and is used only for login. Choose anything — it does not need to correspond to a real identity.

Recovery key

Your recovery key is generated at signup. It is the only credential that can restore account access if you lose your handle or password. Store it offline. We cannot recover it for you — it is never transmitted to or stored on our servers.

Altostratus

Connecting platforms

Altostratus connects to cloud providers via their native APIs. You supply API credentials; Altostratus manages the control plane.

Supported providers

Altostratus connects to sovereignty-first hosting providers, European infrastructure, distributed compute networks, and major commercial clouds. Provider details are available after access is granted. We don't publish our full integration list publicly.

Credential storage

All API credentials are encrypted with AES-256-GCM before being stored. Credentials are decrypted server-side only when you initiate infrastructure operations — provisioning, monitoring, or management actions. Plaintext credentials exist transiently in server memory during active operations only and are never written to logs or persisted outside of encrypted storage.

Platform limits by tier

Operator: 3 platforms. Team: 10 platforms. Infrastructure: unlimited. You can connect any combination of supported providers up to your tier limit.

Altostratus

Managing instances

Instances are the compute resources provisioned through Altostratus across your connected platforms.

Provisioning

New Instance → select platform → select region → configure type and size → deploy. For multi-region deployments, repeat the region selection across multiple platforms in a single workflow.

Infrastructure Builder

The visual canvas lets you map your full topology — providers, instances, connections, and regions. Use it to document architecture decisions and visualize cross-provider deployments.

AI Assist

AI Assist is powered by your own Anthropic API key (BYOK). Your key is stored encrypted alongside your platform credentials and never transmitted to Arctic Bison. Operator tier has chat and Q&A. Team and above adds plan generation and automated execution.

Instance limits by tier

Operator: 10 instances. Team: 50 instances. Infrastructure: unlimited.

Altostratus

Billing via Rudis

All Altostratus subscriptions are processed through Rudis, our open-source crypto invoice processor. There is no card processor, no billing identity, and no payment record linking your subscription to your infrastructure account.

Payment rails

Lightning Network (instant confirmation), Bitcoin on-chain (one block confirmation), and Monero (two block confirmation). Choose the rail that fits your operational requirements.

Renewal

Subscriptions are monthly or annual. You will receive a Rudis invoice before your renewal date. Pay the invoice to continue service. There is no automatic charge — payment is always explicit and operator-initiated.

Altostratus

Privacy architecture

The following is an architectural statement, not a privacy policy. These properties are enforced by design, not by promise.

Rudis

Overview

Rudis is an open-source, self-hosted crypto invoice processor. It generates payment invoices for Bitcoin (Lightning and on-chain) and Monero, tracks payment status in real time, and delivers webhook notifications when payments confirm.

Rudis is the payment infrastructure that Altostratus itself runs on. If you have paid for an Altostratus subscription, you have already used Rudis.

Rudis is MIT licensed. The full source is on GitHub. You can deploy it independently of Altostratus for any application that needs crypto payment rails.

Rudis

Quick start

Docker Compose deploy from zero to running in under ten minutes.

1. Clone the repository Full instructions and the self-hosting guide are in the repository README.
2. Configure environment variables Copy .env.example to .env and set your node credentials (phoenixd for Lightning, Bitcoin node, Monero daemon), webhook secret, and API key.
3. Start with Docker Compose

   docker compose up -d
4. Create your first invoice via API

   # POST /api/invoices curl -X POST https://your-rudis-instance/api/invoices \ -H "X-API-Key: your-api-key" \ -H "Content-Type: application/json" \ -d '{"amount_usd": 49, "currency": "lightning", "description": "Operator plan"}'
5. Handle the webhook Rudis sends an HMAC-signed POST to your webhook URL when payment confirms. Verify the signature, activate the subscription, done.

Full self-hosting guide, manual deploy instructions, and troubleshooting are in the repository.

Rudis

API reference

Rudis exposes a REST API authenticated with an API key. The full reference is in the repository.

Key endpoints

Data architecture

What we collect

This is the complete list of data Altostratus holds on your account. Nothing else is stored.

Handle

The pseudonymous name you choose at signup. It carries no association with your real identity unless you make it identifiable. It is used to identify your session and your account in the audit log.

Recovery key (one-way hash only)

Your recovery key is shown to you once in plaintext and never stored in readable form. Altostratus stores only a one-way HMAC-SHA256 representation — enough to verify the key you provide, not enough to reconstruct it. There is no password reset mechanism. If you lose the key, the account cannot be recovered.

Encrypted provider credentials

The API credentials you supply to connect cloud providers are encrypted at rest using AES-256-GCM before being written to the database. They are decrypted server-side only when you initiate an infrastructure operation — provisioning, monitoring, or management. Plaintext credentials exist in server memory only during active operations and are not logged or written to disk.

Subscription status

Your current plan tier and subscription state. No payment identity is stored — payments are made in cryptocurrency and Altostratus receives only a confirmation that payment was received, not who sent it.

Audit log

A record of actions taken within your account: the action type, the resource it affected, and a timestamp. IP addresses are not logged at any point. The audit log is visible to your account and supports the Emergency Decommission feature.

What is explicitly not collected

Email address · phone number · real name · date of birth · government ID · IP address · browser fingerprint · device identifiers · workload content · traffic payloads · data stored on your infrastructure. The control plane knows that your infrastructure exists — it cannot see what runs on it.

Data architecture

Platform comparison

How Altostratus compares to conventional infrastructure and networking platforms on the data they collect and what can be compelled from them.

For the full privacy architecture, see the Privacy Policy and the Architecture page.