Your code sits on a machine you do not own. Here is exactly what that means.
The disk is encrypted
The whole disk, not a folder on it. A stolen drive reads as noise.
Settings never lie around
Database URLs and API keys are encrypted at rest and handed to your app as a secret.
Your app cannot see anyone else's
It gets its own fenced-off space. The internet and its own database. Nothing else.
No keys to us in your container
Nothing inside your container can ask our cluster for anything.
A copy that survives the machine
Your code and every version are pushed off the box nightly, encrypted before they leave. Your app's own database is not in that copy yet — keep an export of data you cannot lose.
The record we keep
14:32
agent
app.env.set
notes
keys=DATABASE_URL,STRIPE_SECRET_KEY
14:31
agent
app.deploy
notes
version=3
14:28
you
app.logs.read
notes
kind=runtime
14:12
agent
addon.provision
notes/postgres
ok
Setting names. Never their values.
What this is not
So you know where you stand
We run your app, so we can see it while it runs. That is true of anyone who runs your code.
Your app's database is not in the nightly copy yet. Keep your own export of data you cannot lose.
No outside audit yet. We are early, and this page stays exact instead of impressive.