Tenant isolation
Every organization lives behind tenant-scoped queries with PostgreSQL row-level security as a second wall, enforced on every transaction.
SECURITY / ACCESS / OPERATIONS
Private means
enforced.
Package access is checked at the registry. We build controls into publishing, delivery, accounts and the deployment boundary.
Credentials
Passwords use Argon2id. API keys and npm tokens are stored as hashes, while reveal-once secrets stay separate from account sessions. Two-factor sign-in, passkeys, SSO and SCIM protect accounts.
Encryption at rest
Secrets the application stores for you — SSO client secrets, webhook signing secrets, TOTP secrets — are sealed with authenticated encryption keyed by the installation's encryption key.
Package integrity
Published versions are immutable and unpublishing leaves a tombstone. Publish sessions fence concurrent publishers by generation, and request fingerprints reject mismatched replays.
Fail-closed delivery
The registry data plane uses short-lived authorization decisions. If it cannot confirm access, installs are refused rather than served without a check.
Audit trail
Publishes, key changes, membership and plan changes are recorded with actor and time in the organization's audit log, kept under your retention settings.
REGISTRY SECURITY
A key for each
job.
Publisher keys can be narrowed to a registry, scope or package and to the actions a release needs. Download keys are read-only, can grant selected packages, and can be rotated or revoked without changing a package name. Organization API keys are separate from registry credentials.
Trusted publishing can exchange a matching GitHub Actions or GitLab CI identity for a short-lived package publisher credential. Public npm caching is opt-in: a private name or claimed scope never falls through to the public registry, and upstream errors fail closed. Set up trusted publishing →
APPLICATION SECURITY
Defense beyond
the login.
Organization-scoped queries run with PostgreSQL row-level security. Passwords use Argon2id; stored key verifiers use hashes. Sensitive saved integration secrets are sealed with authenticated encryption. Passkeys, authenticator-based two-factor sign-in, recent-sign-in checks for security changes, roles, SSO and SCIM add account controls.
Browser pages set a Content Security Policy, block framing, and use cross-origin request protection with same-site cookies. Requests to user-supplied webhook and identity URLs reject private network destinations.
DEPLOYMENT DESIGN
Separate the
public edge.
The deployment configuration separates the HTTPS edge, registry data plane, application and workers. The registry data plane is configured behind a private Flycast address; its control-plane calls use the private network. The edge handles verified registry hostnames and TLS. App and worker health checks are configured separately.
Deployment workflows use read-only checkout permissions, pinned action revisions and app-specific deploy tokens for the edge and registry. Schema migrations run as the database owner before app rollout; runtime database access uses a distinct application role. The production runbook requires an encryption key and describes backup, restore and key rotation procedures.
These are documented design and deployment controls. We do not claim a third-party certification or a particular backup frequency here.
RELIABILITY AND RESPONSE
Built to be
there when needed.
Production alerts reach engineers around the clock. We monitor application errors, slow requests, background work and delivery failures, and respond to customer-impacting incidents. For help with an active service issue, contact [email protected].
Our Terms of Service describe the current availability commitment. We do not publish an uptime percentage or a third-party certification without evidence to support it.
RESPONSIBLE DISCLOSURE
Found something
we should know?
Report a potential vulnerability privately to [email protected]. Include the affected URL or feature, steps to reproduce, and the impact you observed. Use your own accounts and avoid accessing other people's data or disrupting service. We investigate every report.
Our trust center covers controls, providers and data locations. Evaluating our controls for your team? Talk to an engineer →