Six checks on every request, plugins in sandboxes, and nothing about you sent anywhere.
Every request passes the same checks before it reaches your data, whichever front end sent it. And nothing about how you use it is sent anywhere.
- EdgeAn under-attack check, pattern blocking, per-visitor rate limits, and blocking by country or IP range.
- Sign-inTwo-factor with recovery codes, single sign-on and API keys.
- PermissionsRoles grant create, read, update and delete per collection, checked on every request.
- DataRow-level security in PostgreSQL keeps every site apart. Secrets are stored encrypted.
- PluginsEach runs signed, in its own sandbox with limits. A plugin asking for more needs your approval again.
- RecordAn audit log and a security monitor. An erasure request reaches every plugin.
Nothing leaves your server unless you send it.
- The usage report is off by default. Turn it on in Settings → General to send versions and plugin names. It never carries your domain, your users or your content, and you can see every field before it goes.
- The update check only reads the list of releases. It sends nothing about you.
- A marketplace is contacted only if you add one, and it receives only its own key.
- Alerts go by email to your own administrators, and only when you turn them on.
Inside these limits, in its own process. A version that asks for more waits for your approval.
Every protection, and the operator's checklist- CPU
- Half a core
- Memory
- 384 MB
- Disk
- 100 MB
- Processes
- 64
- Per request
- 30 s
- Runtime
- gVisor, optional
Certificates
Automatic from Let's Encrypt or another ACME authority, or your own. Keys are encrypted, and expiry is warned in advance.
Private until you say so
A new site is private. Its people preview it with a one-time link, then you make it public.
Backups you can preview
See what a restore will change before you run it. A safety snapshot is taken first.
Secrets encrypted
Integration keys and passwords are stored encrypted and never sent to the browser.
AI on a short leash
Agents get scoped tokens, shown once and audited on every call. Remote access starts off.
Erasure that reaches everywhere
A request to erase a person reaches every plugin that holds their data.