Security

• Isolation: each project runs in its own sandbox with its own network, database and storage. Projects can't see each other.
• Encryption: data is encrypted at rest, in Germany. Secrets are stored encrypted and separately, and never shown back.
• Backups: besides snapshots, every project on a paid plan is backed up regularly to a second location, encrypted, and we test restoring from those backups.
• Free apps' outbound traffic is limited to common services, which stops most abuse.
• Scanning: the Security screen (or "scan my app" to your AI) finds the mistakes AI-written apps make most, such as SQL built from strings, HTML from variables, secrets in code, unprotected API routes, vulnerable packages and accessibility problems. Each comes with a fix to give your AI.
• Tamper alerts: the live site is checked against what you published, and a change made outside a publish raises a notice to you.
• Logs are cleaned of keys, tokens and card numbers before they are written.

More on the security and trust page, including how to report a vulnerability.