Docs

Trust center

How we keep your apps and data safe.

The security and privacy practices behind Deployxa: isolation, encryption, access control, safe rollouts and how to report a problem.

Report a vulnerabilityInfrastructure

01 / Isolation

Every app in its own sandbox.

  • One container per app

    Every workload runs in its own container with separate namespaces and memory and CPU limits, so one app cannot starve or read another.

  • Private networking

    Containers sit on an isolated network. Only the TLS-terminating edge proxy can reach them from outside.

  • Filtered system calls

    System calls are filtered to block privilege escalation from inside a container.

02 / Data protection

Encrypted in transit and at rest.

  • HTTPS everywhere

    Every route is served over TLS with certificates from Let's Encrypt, issued and renewed automatically.

  • Encrypted secrets

    Environment variables are encrypted at rest, injected when the container starts and never written to build logs.

  • Signed webhooks

    Git push webhooks are verified with SHA-256 signatures, and repository tokens are kept private.

03 / Access control

The right people, the right permissions.

  • Team roles

    Owner, Admin, Developer and Viewer roles scope who can deploy, edit secrets and manage billing.

  • Audit logs

    Security events, key rotations and member invitations are recorded for your organization.

  • API keys

    Create and revoke API keys for automation from the dashboard instead of sharing passwords.

04 / Operations

Changes that fail safely.

A new release starts next to the old one and only takes traffic after it passes its health checks. Previous releases are kept, so a rollback switches traffic back without rebuilding.

  • Health-checked rollouts on every deploy
  • One-step rollback to a known-good release
  • Scheduled snapshots of the platform database
  • Deploy logs kept per release

05 / Privacy

Your data stays yours.

  • Export and delete

    Export your account data or delete the account yourself under Settings, Privacy.

  • Consent first

    Analytics scripts load only after you accept them in the cookie banner.

  • Payments by processors

    Card details are handled by Stripe and Paystack. Deployxa does not store card numbers.

06 / Responsible disclosure

Found a vulnerability? Tell us.

We welcome reports from security researchers and will not pursue legal action against good-faith research that respects our users. Please give us a reasonable chance to fix an issue before you disclose it publicly.

  • Do not access or change other customers' data
  • Do not degrade the service for others
  • Keep details private until a fix ships

Report a vulnerability

  • The affected URL, endpoint or component
  • Steps to reproduce, with a proof of concept if you have one
  • The impact you observed
[email protected] Email

07 / Policies

The documents behind the practices.

08 / FAQ

Security questions, answered.

How do I report a vulnerability?

Email [email protected] with the affected URL or component, steps to reproduce and the impact you observed. Please do not access other customers' data or disrupt the service while testing.

Does Deployxa hold a SOC 2 or ISO 27001 certification?

No. Deployxa does not hold third-party security certifications today. This page describes the practices that are in place, and we are happy to answer a security questionnaire for your review.

Where is my data processed?

Details on what we collect, why and for how long are in the privacy policy and the data processing addendum, both linked below.

Can I get a signed data processing agreement?

The data processing addendum is linked below. If your organization needs a signed copy, email us and tell us which entity should sign.

Ready when you are

Need a security review?

Send your questionnaire or ask about a specific control, and we will answer in writing.

Email securityCheck status