Security

Projects are kept apart

• Each project environment runs as its own Worker, with access to its own resources only.
• Files go through a storage service that only reaches the project’s own folder.
• Calls your app makes to other servers pass through a filter that blocks private networks and Flatstack’s internal addresses.

Secrets and tokens

• Secrets are encrypted with AES-256-GCM, with a separate data key for each project.
• Access tokens and deploy tokens are scoped, expire, can be revoked, and are stored hashed.
• Every account owner signs in with a second factor: an authenticator app or a passkey.

Backups

Databases can be restored to any point within your plan’s backup window, and are also exported every night. The window is 7 days on Hobby, 14 on Pro and 30 on Studio.

Audit log

Every configuration change, deploy, secret change and member change is recorded, kept for 365 days, and can be exported.

Reporting a vulnerability

Email security@flatstack.dev with what you found and how to reproduce it. We'll reply within two business days, keep you updated while we fix it, and credit you if you'd like. Please don't access other people's data, degrade the service, or make the issue public before it's fixed. We won't take legal action against good-faith research that follows these rules.