Security. What is built, and what is not there yet.

• Each replica of your app runs in its own virtual machine. It does not share one with the apps of other customers.
• The apps of a team are on a private network of their own. The apps of other teams cannot reach it.
• Every app is built in its own build environment, with its own cache. A build cannot read the code or the cache of another app.
• From the internet, an app can be reached on ports 80 and 443 only.

Every app is served over HTTPS, at its platform address and at your own domains. A request over plain HTTP is redirected. The certificates are issued and renewed automatically. The dashboard is served over HTTPS as well.

• Variables are stored encrypted (AES-256).
• Their values are shown only to the owner and the admins of the team. A member can set a variable and cannot read existing values back.
• Every time someone reveals a value, the activity trail records it.

More in the documentation: Environment variables.

• You sign in with a six-digit code sent to your email address. A code works for ten minutes and for five tries.
• How often a code can be requested is limited, for each email address and for each network address.
• There are no passwords, so there is none to leak and none to reuse.
• A browser stays signed in until you sign out, for 400 days at most. Sign out on a computer you share.

Your mailbox is the key to your account. Whoever can read it can sign in. Protect it with a second sign-in step at your email provider.

Each person has an account of their own and joins a team as owner, admin or member. Members deploy and run apps; they cannot read the values of variables and cannot delete an app. Only the owner changes the plan and the payment method. The activity trail lists deployments and changes with who made them.

More in the documentation: Teams.

• You choose which repositories the connection can see.
• We read from them: the code to build, and the commit a deployment came from. We do not write to them.
• Access to GitHub uses tokens that are created when they are needed and expire within an hour.
• When GitHub tells us about a push, the notice is checked by its signature before anything is done with it.

Card details are entered at the checkout of our payment provider and never reach our servers. We keep the brand of the card, its last four digits and its expiry date, so that the billing settings can show which card is used.

A small number of authorized staff can see accounts, teams, apps and billing records. To give support, or to look into a fault or abuse, they can sign in to a customer's account through a link that works for two minutes. Creating such a link and using it are recorded, with who did it and from where. They do this for those reasons only.

This website and the dashboard use no analytics, no session recording and no advertising. The cookie policy lists the few cookies the dashboard needs, and the privacy policy says what data we hold.