Security

The five layers between the internet and your app's data, from the network edge to the rule on each record.

Your live app runs on a production server that we own and run, never on a client machine. Five layers stand between a visitor and your data. Each one works even if the one before it fails.

1. The app listens only inside its server#

The app accepts connections only from its own server, never from the network. After each start, the server checks what the app listens on. A version that listens anywhere else is refused and the previous version comes back within seconds.

2. One locked down system user per app#

Each app runs as its own system user, with no shell, no home folder and no administrator rights, and it cannot gain new rights. That user owns only the app's data folder, which no other app can read. The app's code is read only to it. The program that starts and stops apps has the narrow rights it needs for that, and nothing more.

3. One front door#

The server's firewall opens the web ports only: no app has a port of its own on the internet. One web server in front receives every visit, over HTTPS, and passes each app's address to that app alone. A request for any other address gets nothing, and gets no certificate. Each app's certificate comes from Let's Encrypt and renews by itself.

4. Access at the edge#

Each app has an access setting, applied by the front door before a request reaches the app:

Anyone with a login (the default): anyone reaches the sign in page. The app's own sign in is the gate.
Listed IPs only: only the internet addresses on the app's list reach it at all. Everyone else is blocked at the front door.

See App settings.

Behind all of it, the app itself decides:

Sign in with a password checked against a strong one way hash (bcrypt), sessions that end after 12 hours by default, an optional code by email or a second step for sensitive roles, and a slowdown after repeated attempts. See Sign in and accounts.
A server rule on each kind of record and each action: list, view, create, change, delete. A rule the app does not write means "nobody but the root account". Every value in a filter is passed to the database as a value, never as code.
Private files open only through short lived links, after the record's own rule.

Deploys that cannot break the live app#

A new version is built on our build machine, then checked on the server: it must answer its health check and listen only inside the server. If either check fails, the previous version comes back by itself. See Release and deploy.

Not done yet#

Certifications such as SOC 2 or ISO 27001. We have none today.
Backups of the live apps run inside each app, when the app turns them on. See Backups.

This page as markdown