How app.nz protects your code, data, and keys
Encryption, key handling, isolation, subprocessors, and how to report a problem. For feature controls, see enterprise.
the model
Six things we hold to
Encryption in transit
Public endpoints are TLS-only (1.2+, 1.3 preferred) behind the Cloudflare edge. Internal hops across machines run over encrypted tunnels; plaintext HTTP never leaves a host.
Encryption at rest
Databases, git repos, build artifacts, and uploads live on encrypted volumes. Backups are encrypted before they leave the origin machine.
Key handling
Platform API keys are stored as salted hashes. Plaintext is shown once at creation and can only be rotated, never recovered. Provider keys and app secrets are injected at runtime, scrubbed from build and CI logs.
Isolation model
Agent runs and app workloads run in dedicated containers; GPU/CPU jobs run in per-job VMs on the upstream provider. Runs get scoped, short-lived credentials; untrusted code is sandboxed with network, filesystem, and time limits.
Data deletion
Export or delete your account from settings; both are audit-logged. Deletion removes account rows, repos, deployments, and stored artifacts. Backups age out on their normal rotation (30 days or less).
Access control
Organization RBAC (owner / admin / member / viewer), per-org audit logs, and every admin action gated server-side.
vulnerability reporting
How to report a vulnerability
Contact
Email [email protected] with reproduction steps and impact. A person replies, usually within one business day, with updates until it is resolved.
Safe harbor
Good-faith research on your own accounts is welcome: no legal action for testing that avoids service disruption, other customers' data, and social engineering. Give us reasonable time to fix before disclosure; we credit reporters.
subprocessors
Our subprocessors
Model providers see only requests you route to them; the gateway never mirrors traffic to other providers.
| Subprocessor | Purpose | Location |
|---|---|---|
| Hetzner | Compute for hosted apps, agents, and databases | Germany / Finland / US |
| Cloudflare | Edge network, DNS, TLS termination, tunnels | Global |
| Google Cloud / Firebase | Sign-in (Google, GitHub, email) and identity tokens | US / EU |
| Stripe | Payments and billing; card data never touches our servers | US |
| AWS (SES) | Transactional email (invites, receipts, resets) | US |
| GitHub | Optional repo integration and the GitHub App webhook | US |
| RunPod | Serverless GPU execution tier for some workloads | US / EU |
| Model providers (OpenAI, Anthropic, Google, and others) | Inference, only for requests you route to them through the gateway | US / EU |
Security review and contact
Questionnaires, DPAs, and architecture walkthroughs go through [email protected]. Vulnerabilities go to [email protected].