An overview of the measures that protect your application and its data, described as they are actually operated.
Encryption at rest
Your files, your database and everything your application writes are encrypted at the storage device itself. A drive separated from the server cannot be read without keys that are not held on it. In Singapore the entire machine is encrypted; in Thailand encryption covers all customer data.
Passwords and API keys
Database passwords, API keys and every environment variable you set are encrypted before they are stored, and are placed into your application's memory only as it starts. No screen displays them again afterwards, and none is written to a log.
Isolation and network control
Each application runs in an environment separated from every other, under a network policy of its own. It can reach the public internet and its own database, and nothing else: another customer's application is neither visible nor reachable from it.
Privilege limits at the infrastructure level
An application holds no credential or key to the host system it runs on. Should an application have a vulnerability, there is nothing within its reach that would allow the boundary to be crossed into the platform.
Daily cross-border backups
Your source code, every deployed version and your account records are backed up nightly, encrypted before they leave the machine, and held in a country separate from the server that serves you.
Where the infrastructure is
Applications and customer data are served from a data centre in Thailand, for fast response times for users in the country. Account records and backups are held in a data centre in Singapore. Both are encrypted, and the providers we use are listed on our privacy page.
Security Audit Trail
14:32
agent
app.env.set
notes
keys=DATABASE_URL,STRIPE_SECRET_KEY
14:31
agent
app.deploy
notes
version=3
14:28
you
app.logs.read
notes
kind=runtime
14:12
agent
addon.provision
notes/postgres
ok
Audit logs record configuration variable names, never sensitive values.
Operational notes
While your application is running, its data is processed in the memory (RAM) of a server operated by Erawan, which is the standard operating model for cloud hosting.
Daily backups cover source code and account records. They do not replace an export of your application's own database, which you may take at any time and should take periodically.