Backups and security

Backups. The platform database is copied every night to storage in the Netherlands, and those copies are kept for ninety days. Each copy is checked after it is made: if it is missing or suspiciously small, that is reported the same night instead of quietly rotting for three months. Restoring has been tested, not just described.

For your own site, the files you published are the backup: you keep the source in your own tool or repository, and republishing takes seconds. For an app with a database, the database is included in the nightly copy.

Encryption. Everything runs over HTTPS with a certificate we arrange and renew automatically. Traffic to the platform and to your own domain is never plain. Stored data sits on encrypted disks.

Access. Only the owner has administrative access to the platform. Passwords are stored as hashes, never readable, and login attempts are throttled after five failures from the same address.

Headers. Every page is served with the usual protective headers: no content sniffing, no embedding in a frame elsewhere, a strict referrer policy, and HTTP Strict Transport Security.

What you are responsible for. The content of your own site and app, and the strength of your own password. If your app talks to a database, keep secrets out of the source and put them in the environment variables in the portal.

Found something wrong? Report it through support with the word security in the subject. We look at it the same working day, and we never hold it against the reporter.