Security & data safety
How Apprail keeps your workloads apart, your secrets secret, and your data recoverable — and, just as important, where the current limits are.
Isolation
- Every environment has its own private network. Its services and data can reach each other; other environments, projects, and workspaces can’t reach them. Databases, caches, queues, and buckets have no public address.
- Root in a container isn’t root on the server. Every container runs in its own user namespace: an image that starts as root still works, but that root is an unprivileged user on the machine underneath.
- Containers run with reduced privileges: no privilege escalation, a default seccomp profile, and dangerous Linux capabilities removed.
- Buckets have one key each, which can’t touch other buckets.
- Pull requests from forks are never built, so outside code never runs with your variables.
Secrets
- Variables, registry passwords, and alert URLs are encrypted at rest, each bound to its workspace.
- Database, cache, and queue passwords are generated per resource and delivered to your services when they deploy; they aren’t kept in Apprail’s own database.
- Variable values are visible only to members who can change them; viewers and read or deploy tokens see names. Registry passwords and alert URLs are never shown again after you save them.
- Private GitHub builds use a token scoped to one repository that expires within an hour and never appears in URLs, logs, or images.
- Revealing a database password, opening a tunnel, running a command, and exporting with values are all recorded in activity.
Access control
- Roles, scoped tokens, and short-lived agent tokens — see Team & access.
- Approvals, protection changes, session management, and exporting values need a person in the console; no token can do them.
- GitHub webhooks are verified by signature, and each delivery is processed once.
- Invitation links are single-use, bound to an email address, and never sent to a server in a URL path.
In transit
Visitors connect over HTTPS to Cloudflare’s edge, which connects to Apprail’s region over TLS. Database tunnels are encrypted end to end between your client and Postgres. Traffic between services and data inside one environment stays on its private network and isn’t additionally encrypted.
What’s backed up
| Data | Protection |
|---|---|
| Postgres | Continuous log archiving and a daily base backup to offsite object storage; restore to any moment into a new database. Backups are kept after a database is deleted |
| Object storage | Copied offsite nightly (a copy, not a point-in-time archive). Deleting a non-empty bucket is refused |
| Caches | Not backed up. Memory-only by default; optional persistence to one disk |
| Queues | Not backed up. Persistent messages survive restarts, on one disk |
| Your configuration | apprail export at any time |
Where your data is
Your services and data run in Apprail’s region in Šiauliai, Lithuania. Visitors’ requests pass through Cloudflare’s global edge. Backups are stored in Cloudflare R2.
Current limits
Apprail is in private alpha. Each database, cache, queue, and the object store is a single instance without failover, so a machine failure means a period of unavailability until it restarts elsewhere. Builds run in a hardened, rootless builder and containers share the server’s kernel, and an independent review of isolation for fully untrusted code is still to come — which is one reason access is by invitation. MFA is handled by your sign-in provider (GitHub or Google) for now.