security
values encrypted before they're stored (aes-256-gcm). every project runs isolated from everyone else's. every deploy scanned for exposed keys before it ships.
your secrets
environment variables, api keys, and oauth credentials are encrypted before they're stored (aes-256-gcm), with a fresh random iv for every value. the decryption key lives on the server and nowhere else: not in your page source, not in your containers' images. your app receives its env at deploy time; the dashboard only ever stores the ciphertext.
your code
every project runs in its own container: sites and functions both. there is no shared sandbox: your function is a process in your container, not a vm context inside somebody else's. the agent that builds and runs containers authenticates with a token scoped to your project alone.
leaked keys
before any deploy goes live, free or paid, its source is scanned for exposed credentials: stripe keys, database urls, oauth secrets, your own vault values. hits show up in the deploy output with the match redacted. for members, pushto errors also re-checks the live site from outside after it ships: served bytes, plus the classic mistakes like a reachable .env.
your rows
the database enforces row-level security. the role the dashboard runs as can only read rows that belong to the signed-in owner. project isolation is a database policy, not an if-statement.
sessions
auth session tokens are signed with a secret that exists only server-side. the public api key that ships in your page source can verify nothing and mint nothing: a copy of your frontend cannot forge a login.
your database
backed up nightly to a separate provider, locked against deletion, restore-tested monthly. the whole story is on the durability page.
what we don't promise
no soc 2 report. no pentest badge. every claim above is checked against the code automatically. the day the code stops backing one, this page fails the build.