Start
Security, as it is

Written from what is true, not from what sounds good.

Every line below is a measure in place today. What is still in progress is said as plainly, further down.

Two factors on every sign-in.A password and an emailed code. Separate credentials for customers, Apptains and the desk, so one taken from one surface opens no other.
Conversations sealed at rest.Your chat with the AI and with your Apptain is encrypted with AES-256-GCM before it is written down. So are the keys your sites use.
One project per machine.Your build runs alone, never beside another customer's, and the machine that runs it holds none of the platform's keys.
Keys stay keys.Dev and Live keys are stored sealed, never committed to code, never shown back in full. Changing Live's asks you to confirm it is you.
Every turn is kept.Your project is a git repository, archived off the machine after every change. Nothing depends on one machine staying up.
Every publish is scanned first.Before a new version runs on your server, its files are checked for the usual tricks, and a copy of the site and its databases is taken.
The actions that matter ask again.Paying, Live's keys, inviting, deleting the account: one emailed code, good for an hour.
What we log, we redact.Secrets and personal details are removed from logs centrally, one-time codes are never written down, and request logs are kept for thirty days.
In progress

Said out loud.

We are working towards SOC 2 and ISO 27001 certification. Neither is awarded yet.

An independent penetration test is being arranged. There is no report yet.

A published uptime commitment is being prepared. Until then, one can be agreed in a Statement of Work.

Your data

Kept, and then not.

Your data is processed outside India, in the European Union and, for a server you choose there, Singapore.

Request logs are kept for thirty days. Your code and your conversations are kept for the life of the business.

Deleting your account signs you out now and erases everything after the grace period on the delete your account page. Payment records are kept as the law requires.

Found something? Write to abuse@apptains.com. Acknowledged within one business day, and at once where harm is active.

Start with the thing that slows you down today.

Describe it. See a first version today. Hand it to an Apptain whenever you like.

Start buildingTalk to us