How app.nz protects your code, data, and keys
The concrete model: what is encrypted, how keys are handled, how workloads are isolated, who our subprocessors are, and how to reach us when you find a problem. For feature-level controls, see enterprise.
the model
Six things we hold to
Encryption in transit
All public endpoints are TLS-only (1.2+, 1.3 preferred) behind the Cloudflare edge. Internal service hops that cross machines run over encrypted tunnels; plaintext HTTP never leaves a host.
Encryption at rest
Databases, git repositories, build artifacts, and uploaded assets live on encrypted volumes. Backups are encrypted before they leave the origin machine.
Key handling
Platform API keys are stored as salted hashes — plaintext is shown once at creation and cannot be recovered, only rotated. Bring-your-own provider keys and app secrets are injected into workloads at runtime and scrubbed from build and CI logs.
Isolation model
Agent runs and app workloads execute in dedicated containers, and provisioned GPU/CPU jobs in per-job VMs on the upstream provider. Each run gets scoped, short-lived credentials; untrusted code is sandboxed with network, filesystem, and time limits.
Data deletion
Request account deletion or a data export self-serve from settings; both are audit-logged. Deletion removes your account rows, repos, deployments, and stored artifacts, with backups aging out on their normal rotation (30 days or less).
Access control
Organization RBAC (owner / admin / member / viewer), per-org audit logs, and admin actions gated server-side on every request — never by hiding UI.
vulnerability reporting
Found something? Tell us directly
Contact
Email [email protected] with reproduction steps and impact. You will get a human response — typically within one business day — and status updates until the issue is resolved.
Safe harbor
Good-faith research against your own accounts and data is welcome: no legal action for testing that avoids service disruption, other customers' data, and social engineering. Give us reasonable time to fix before public disclosure; we credit reporters who want it.
subprocessors
Who touches your data, and why
We keep this list short on purpose. Model providers only see the requests you route to them; the gateway never mirrors traffic to providers you did not pick.
| Subprocessor | Purpose | Location |
|---|---|---|
| Hetzner | Compute for hosted apps, agents, and databases | Germany / Finland / US |
| Cloudflare | Edge network, DNS, TLS termination, tunnels | Global |
| Google Cloud / Firebase | Sign-in (Google, GitHub, email) and identity tokens | US / EU |
| Stripe | Payments and billing; card data never touches our servers | US |
| AWS (SES) | Transactional email (invites, receipts, resets) | US |
| GitHub | Optional repo integration and the GitHub App webhook | US |
| RunPod | Serverless GPU execution tier for some workloads | US / EU |
| Model providers (OpenAI, Anthropic, Google, and others) | Inference — only for requests you explicitly route to them through the gateway | US / EU |
Questions a table can't answer?
Security questionnaires, DPAs, and architecture walkthroughs go through [email protected]. Vulnerabilities go to [email protected].