Security in the request path, not bolted on
We run our own WAF, DDoS shield and rate limits in front of the platform API — and protect accounts with passkeys first. Security isn't a vendor we add; it's part of the platform.
How we protect you
Our own edge defence
WAF, DDoS absorption and rate limits run on our own capacity in front of the platform API, and there's no third party between your users and your app. Your apps get a per-IP rate limit at our gateway today; the firewall in front of them is coming soon.
Passkeys first
WebAuthn passkeys are the default, with Google sign-in and passwords as fallbacks. Phishing-resistant auth out of the box.
Encryption everywhere
TLS on every endpoint, and secret and environment-variable values are encrypted with AES-256-GCM before they are stored, under a platform master key with a documented rotation procedure. We do not claim database-wide encryption at rest.
Audit logs
Privileged actions are recorded in an audit log that our operators review. A customer-facing audit log and export is not available yet.
Isolation by design
Per-tenant boundaries in the API and database keep accounts separated. V8-isolate separation for edge functions is in preview.
Responsible disclosure
Found something? Send it through the contact form and mark it as security.
Report a vulnerability
Signups are invite-only right now — request access and we'll follow up.