Networking & Security
Isolation enforced outside your container, only what you publish exposed, and an account you can lock down.
| Service | Role | Exposure | Reachable from |
|---|---|---|---|
| ghost | web | Public | blog.yourdomain.com, HTTPS |
| mysql | database | Private | This app only |
| redis | cache | Private | This app only |
| — | outbound smtp | Blocked | Port 25, by defaultdefault |
Isolation outside the container
Boundaries apply at the host, not inside your container. Exactly one service per app is published to the internet; everything else it needs is reachable only on a private network between your own containers. The rule holds even when the app is misconfigured, restarting, or already compromised — the three moments an in-app control helps least.
Containers run unprivileged, with the host root user mapped away from theirs, capabilities dropped, and a disk quota that is theirs alone. A noisy or compromised app cannot fill the disk out from under its neighbours, and it cannot reach them.
Networking
Addressing, and what happens to it later
The part most hosts leave vague until you try to move.
Your address never moves
Apps are reached by hostname -- yours under our domain, or a custom domain you point at us. Hardware and provider changes underneath do not change how your app is reached; we have moved once already and customers kept their addresses.
IPv6, included
Apps are reachable over IPv6 as well as IPv4 at no extra charge, with no configuration on your side.
Certificates handled for you
Point a record at your app and the certificate is issued and renewed automatically. The panel checks your DNS first and tells you what is wrong when it is wrong, rather than failing quietly.
Secrets encrypted at rest
Generated passwords and your app's environment are stored encrypted with AES-256-GCM, decrypted only at deploy. A copy of our database is not a copy of your credentials.
Port 25 closed by default
One rule, everywhere, and the reason everything else can stay open. A single compromised app spraying spam is what gets a netblock listed -- and every customer on it pays. Ask and we will open it for yours.
Bandwidth you can see
Transfer is sampled continuously and shown against your subscription in the panel, so you know where you stand well before a limit matters rather than finding out on an invoice.
More on the network itself — peering, latency and addresses you can ping.
Your account
Security that is not only about the app
Most hosting incidents start at the control panel, not the machine.
Two-factor, and API keys that are not passwords
TOTP from any authenticator app. API keys carry per-resource read and write scopes, are displayed once at creation and stored only as a hash -- so a key cannot be read back out of our database, by us or by anyone who reaches it.
An audit log you can read
Every change on your account is recorded with the action, the target and the source address, and your own rows are visible to you in the panel. Most hosts keep that for themselves.
Sessions that assume theft
Refresh tokens rotate on every use. Replaying an old one is treated as a stolen token and signs every session out, rather than quietly handing a fresh pair to whoever presented it.
Secrets encrypted at rest
Credentials the platform holds for you -- app environment variables, database passwords, SSH material -- are encrypted with AES-256-GCM rather than sitting in a readable column.
New API key
Grant only what the script needs
Shown once at creation, stored only as a hash. Lose it and you rotate it — we cannot read it back to you, and neither can anyone who reaches our database.
Questions
Frequently asked questions
Deploy something locked down
Isolation, HTTPS and two-factor are on every plan, including the smallest.