Security
The platform is designed around one assumption: deployed code is untrusted. These are the controls actually in place — not aspirations.
Your code never runs on our servers
Builds execute on your machine; the platform receives only the build output. Artifacts are validated before extraction: no symlinks, no path traversal, strict size and entry limits.
Secrets encrypted at rest
Environment variables are encrypted with AES-256-GCM before storage, never appear in logs and are never displayed after being saved. Changes are audit-logged by key name only.
Tenant isolation
Every query is scoped by organization derived from the authenticated context — never from request input. API tokens are stored as SHA-256 hashes with per-token scopes, expiration and revocation.
Verified deployments
Every deployment ends with a real HTTP health check against the published URL. Non-2xx responses fail the deploy — broken releases do not go live silently.
Payment integrity
Payment state changes only through Stripe webhooks with validated signatures, deduplication and controlled retries — never from the frontend. Card data never touches SimDeploy servers.
Audit trail
Sensitive actions — plan changes, credit entries, permission and configuration changes — are recorded with before/after state, actor, IP and user agent.
Serving protections
Published sites are served with path-traversal protection and a content-type allowlist. Rate limiting applies per identity on the API, per IP on authentication, and per organization on deploys.
Found a vulnerability? Report it to support@simdeploy.com. Good-faith research on your own account is welcome. See also the Data Processing Agreement and Privacy Policy.