Here is how we protect your project, your apps' data and your visitors, without the jargon.

The Files You Upload

• Your files are never run during the review; they are only read.
• .env files inside your zip are not published. Only public values with the VITE_, NEXT_PUBLIC_, PUBLIC_, REACT_APP_ prefixes are passed to the build. These values are embedded in the page code, so visitors can see them. You enter passwords and API keys separately in your app's settings; they are stored encrypted and are never shown back, not even to you.
• If we see a key or password left exposed in your files, we warn you before publishing.

Apps Run Separately

• Every server app runs in its own container with its own CPU and memory limits.
• Every app has its own database; one app cannot reach another app's files or data.
• Website files are only served to visitors; they are never run as code on the server.
• Every address opens over HTTPS, through an encrypted connection.

Your Data

• Your live projects and databases are kept on servers we manage ourselves and are not copied to a third-party cloud service. When a new version goes live, the old one is deleted.
• Your account password is stored only as a one-way hash; even we cannot see it.
• When you delete an app, its files, settings, databases and publish records are removed within minutes.
• The address of a deleted app is never given to anyone else, so your old links can never lead to someone else's site.

Your Account

• New accounts are opened with email verification; the sign-up and sign-in forms are protected against automated sign-ups and password guessing.
• Addresses containing the names of banks, public institutions or well-known brands cannot be taken, which stops look-alike sites.

Abuse

Every site on the Free plan has a small "Report" link in the corner. We review reports within 24 hours on weekdays; sites reported by two or more people in a short time for phishing or malware are taken down without waiting for review. Details are on the Acceptable Use page.

Found a Security Issue?

If you think you have found a security vulnerability in Ai to App, write to us from the contact page with the subject "Security". We get back to you within 24 hours on weekdays. Please don't share the details until it is fixed.