Security

How BasicDeploy isolates workloads and protects credentials.

Last updated: July 2026

Isolation

Every application runs in its own container with its own filesystem, its own PostgreSQL database and its own storage bucket, each with dedicated credentials. Containers are given fixed memory and CPU limits so one workload cannot starve another.

Encryption

Database passwords, storage keys and SSH private keys are encrypted at rest using AES-256-GCM with a per-value initialisation vector. Traffic to the platform and to your applications is served over HTTPS.

Access control

Sign-in uses single-use magic links that expire after fifteen minutes. API keys are stored only as SHA-256 hashes, are shown to you once, and cannot be used to create or delete other API keys. Sharing grants access to an application without ever exposing its credentials.

Reporting a problem

If you believe you have found a vulnerability, email [email protected] with the details and how to reproduce it. Please give us a reasonable opportunity to fix the issue before disclosing it publicly.