security

Secrets belong in a vault, not in your code

Your API keys and passwords live in an encrypted vault and reach your app at run time. HTTPS and access restrictions are on by default.

A porcelain vault sphere with a glass key in front and a protective ring around it

Secrets are stored encrypted

Your environment variables do not travel in plain text. They stay encrypted in the vault and are opened only to your running container.

HTTPS from day one

Every app gets a TLS certificate issued and renewed automatically. You keep no certificate calendar.

Private repo isolation

Private repos run in an isolated environment with end-to-end encryption; your code is pulled from your own repo at run time and is not stored with us.

The layers of security

  1. 01

    In transit

    All traffic to your domain is encrypted with TLS, and the certificate is managed for you.

  2. 02

    At rest

    Secrets and connection details are held in an encrypted vault and appear masked even in the panel.

  3. 03

    On access

    Your databases are protected by an IP allow list; only the apps and addresses you define can connect.

  4. 04

    In code

    Your source code is not stored with us. Private repos get an isolated, encrypted runtime.

Technical details

TLS
Automatic certificate + renewal
Secret storage
Encrypted vault, injected at run time
Database access
IP allow list, closed by default
Private repo
Isolated encrypted runtime
Code storage
Source code is not stored
Browse the docs
flow

From vault to container

The key sits encrypted in the vault; it is opened only at run time, and only to your container.

encrypted container