Isolated by design.
The platform was designed from day one to run strangers' code side by side. We assume one layer will break one day; the others must still hold.
Isolation
A sandbox per workload
Every function, database, cache and build runs in its own process, as its own system user, with no privileges and a read-only file system.
Limits enforced by the kernel
CPU, memory and process counts are capped by the operating system kernel, not by trusting the code. Only the system calls each kind of workload needs are open.
A closed network
Customer code has one way out, and that path blocks internal network addresses and our own servers. A function's link to a database or cache is checked against its own team.
Escape tests from inside
Repeatable tests from inside a function and a build try to reach another customer, the host or the network. They are rerun after every significant change.
Accounts and access
No passwords
Sign in with a single-use 6-digit code by email (with a sign-in link) or by SMS. There is no password to leak or reuse.
A second factor for sensitive actions
Creating an API key, changing the plan or tax details, restoring a database and approving a CLI login are confirmed with another factor: an authenticator app or a code on your other channel.
Two channels, each recovers the other
Sign-up verifies both an email and a mobile number. If one is out of reach, the other gets you in.
Short-lived codes, few tries
An email code lasts 10 minutes and an SMS code 5, and 5 wrong guesses kill it. The answer is the same whether an account exists or not.
Sessions you control
A list of open sessions; sign out of any one, or everywhere.
Roles
Owner, admin, developer, billing and viewer. No key or invite can be wider than the role of the person making it.
API keys with a role and an expiry
Each key has its own role and expiry, is stored only as a hash and is shown once. Rotate or revoke it with one command.
Audit log
Every change to the account is recorded with who made it, in the team's audit log.
Passkeys
Sign in and confirm sensitive actions with a fingerprint, your face, your device lock or a hardware key: no code, and only on our site.
Data and secrets
Encrypted secrets
Each secret is encrypted under your team's key, never appears in logs or on disk in clear, and is opened only in the function's memory.
A narrow database role
Your database user is not a server admin and cannot run programs or create roles.
Inside Iran
Data and backups stay on infrastructure inside Iran.
HTTPS everywhere
Every address, including previews, databases and caches, is encrypted.
Reporting a vulnerability
If you find a security problem, please tell us at […] before making it public. We reply within […] and stay in touch until it is fixed.