Skip to content

Security

What your teams build runs inside fixed guardrails.

Every app is checked before it goes live, runs isolated without network and reaches data only through checked calls. This page explains how that works, how people sign in and where your data lives.

Checked before going liveIsolated, no networkOne-click rollbackAudit log with export

Safe apps

The guardrails apply to every app, whether you built it or installed it from the App Store. Nobody has to add them, nobody can forget them.

Checked before it goes live

  • Every version is built and checked: the data model and access rules are verified, records are classified as internal, personal, sensitive or tax-relevant
  • Every page is opened in a real browser as every test persona, e.g. "as a manager: no salary visible"
  • A version goes live only when the check passes. A failed build or check never goes live

Isolated, without network

  • App code runs in its own sealed-off runtime (workerd isolates)
  • No network access: apps reach neither the internet nor other workspaces
  • No credentials or API keys in app code

Every access is checked

  • Apps write no SQL. Every data access goes through the SDK and a capability gateway
  • The gateway checks every single call against workspace, app and the person's permissions
  • Workspaces are separated at database level (row-level security). The workspace always comes from the session, never from the request

Reversible and traceable

  • Every version is kept, the previous one is live again in one click
  • Installed apps update automatically or only after your approval, set per app
  • An audit log records who changed what and can be exported as CSV from the admin area

Sign-in

You choose how your team signs in. SSO and the email code always stay available.

Ways to sign in

  • Single sign-on with Google Workspace and Microsoft Entra ID
  • Passwordless by email: magic link or 6-digit code, short-lived and single-use
  • SAML 2.0 for Okta, OneLogin and similar providers on the Enterprise plan

Passwords and protection

  • Passwords like in Google Workspace: a start password from the admin, changed at first sign-in
  • Stored only as an argon2id hash, new passwords are checked against known breaches. Changing a password ends every other session
  • Admins can turn passwords off for the whole workspace
  • Bot protection and rate limits per account and IP on signup, code and password entry

Data and hosting

Where your data lives, where AI calls go and how you get your data back out.

Hosted in Frankfurt

  • The platform's database and application run in Frankfurt, Germany
  • Files live in object storage, never as binary data in the database
  • Data Processing Agreement (DPA) on request

AI calls

  • Model calls go through commercial providers (OpenRouter), not consumer services
  • In EU mode they run through AWS Bedrock in the eu-central-1 region

Your data stays yours

  • The code of every app you build lives as a git repository in your workspace
  • Data can be exported, workspace deletion on request
  • Shared apps share design and code, never data. Screenshots come only from test data

Connected accounts

  • Connections to Slack, Gmail, Google Drive, Microsoft 365, HubSpot, Jira, Asana and more via OAuth
  • Connecting and disconnecting is recorded in the audit log

Safe here means checked, isolated and reversible. Whether an app gets the substance right is your call, and a support contract helps with that.

Security questions from your IT

Your IT team wants the details? We send a security overview, a description of the data flows and the DPA, and answer your questions directly.

Contact security team

Build the app you are missing.
Safe from the first version.

Signed up in 30 seconds, with email, Google or Microsoft. The workspace is ready right away, no setup, no credit card.

Start for freeRequest a demo

Trial with €15 of AI credit. No credit card required.