# Security (https://lazyfrog.dev/docs/security)

- **Isolation:** each project runs in its own sandbox with its own network, database and storage. Projects can't see each other.
- **Encryption:** data is encrypted at rest, in Germany. Secrets are stored encrypted and separately, and never shown back.
- **Backups:** besides [snapshots](/docs/snapshots), every project on a paid plan is backed up regularly to a second location, encrypted, and we test restoring from those backups.
- **Free apps' outbound traffic** is limited to common services, which stops most abuse.
- **Scanning:** the Security screen (or "scan my app" to your AI) finds the mistakes AI-written apps make most, such as SQL built from strings, HTML from variables, secrets in code, unprotected API routes, vulnerable packages and accessibility problems. Each comes with a fix to give your AI.
- **Tamper alerts:** the live site is checked against what you published, and a change made outside a publish raises a notice to you.
- **Logs** are cleaned of keys, tokens and card numbers before they are written.

More on the [security and trust page](/security), including how to report a vulnerability.