GoLocomotiveSecurity and ownership
You trust us with your business data and with code that AI agents write. This page says what protects both, what stays yours, and what is not done yet.
Your app runs alone
Its own process
Your app is one program. It serves its screens, its data and its admin. No other customer’s app runs in it.
Its own database
One database file and one folder of uploaded files, in a folder only your app’s system user can open.
Its own code
Each app is a separate code repository. Every change is a saved step in its history, with a message that says what changed and why.
Five layers in front of your data
Your live app runs on a production server that we own and run. Each layer works even if the one before it fails.
It listens only inside its server
After each start, the server checks what the app listens on. A version that listens anywhere else is refused, and the previous version comes back.
One locked down system user per app
No shell, no administrator rights. It owns only its data folder, and its code is read only to it.
One front door
The firewall opens the web ports only. One web server in front carries your app’s address to your app alone, with HTTPS.
Access at the edge
Anyone reaches the sign in page, or only the internet addresses on your list. Everyone else is blocked before the app.
The app’s own sign in and rules
Strong password hashing, sessions that end, an optional second step, a slowdown after repeated attempts, and a server rule on every action on every record.
A new version must answer its health check and listen only inside the server. If either check fails, the previous version comes back by itself. Security, in detail
Who can reach your data
| who | reaches | how |
|---|---|---|
| your users | what their role allows | the app’s screens, through its server rules |
| your own AI | what the signed in account allows | the app’s MCP server, through the same rules |
| the app’s root account | everything in the app | used by our portal to manage your users at your request |
| our agents | the working copy only, never the live data | a separate copy on our build machine |
| other customers | nothing | a separate process, database and system user |
Backups run inside the app, on a schedule and with a store you choose: the server’s disk or a storage bucket. Each one is a full, consistent copy of the data at one moment, and a restore checks it before it swaps anything. Your data
Your app is yours
Your app’s code and data are yours from day one. You get the full repository on request, at any time, and you leave with it whenever you want. The locosdk version your app runs comes with a perpetual license.
- The code is a full repository: every file of your app and its whole history of changes. Ask for it at any time, during the project or when you leave.
- locosdk is the shared toolkit your app is built on: sign in, lists, files, backups and the rest. The version your app runs comes with a perpetual license, so it has no end date.
- The whole database is a standard SQLite file in the open PocketBase layout. PocketBase, an open source backend, opens it as it is.
- Backups are zip files of the data folder, in the format PocketBase uses.
- Lists export to CSV, filtered as you like.
- Undeploy stops the live app and takes its address down. Its data stays on the server, so a later deploy brings it back as it was.
Agents work in a closed space
- Each run starts inside the operating system’s sandbox. It reads and writes your app’s code folder only, and reaches two services: the package registry and the AI provider.
- Each run stops at a spending limit, one US dollar by default. The card of each run shows what it spent.
- An agent cannot release, deploy, approve its own work, or reach your live app. How agents are contained
Not done yet
- Certifications such as SOC 2 or ISO 27001: we have none today.
- A data processing agreement and the legal terms of the service are not published.
- The name of our hosting provider is not published. The production server itself is in Amsterdam, in the European Union.
- On the build machine, the working copy of an app does not yet run as its own system user. The live apps already do.
- A mail to your admins when a scheduled backup fails: today the failure goes to the app’s log.
Questions about your data?
This page says what is true today, and what is not done. GoLocomotive is in private testing. Access is by invitation. Once you are invited, ask us anything before you decide.