Security
Built to be trusted with your data. And your agents.
Every request is checked the same way, whether it comes from a person in the editor, a script or an agent. Access is granted, scoped and revocable, every change is attributed, and the controls on this page are tested in CI, not just written down.
Isolation, tested
CI tries every API operation with other organizations' IDs, and fails the build if one gets through.
Keys scoped to their job
Every script and agent gets only the access it needs, and can be cut off at once.
Traceable and reversible
Every change says who made it, through which client and why, and deletions can be undone for 30 days.
No passwords
People sign in with one-time codes, so there is nothing to leak or reuse.
Your data is yours alone. Tested on every endpoint.
Isolation between organizations isn't a code-review promise: the test suite checks it for every operation of the API. And it is encrypted, and hosted in the United States.
Tenant isolation, tested. For every API operation, CI tries missing credentials, the wrong role, a key without the needed scope and other organizations' IDs, and fails the build if any gets through.
Nothing to discover. Another organization's data answers “not found”, never “forbidden”, so its existence doesn't leak either.
Encrypted in transit and at rest. Everything is served over TLS, and the API, the web app and this site send HSTS so browsers never fall back to plain http. The database, the search index and your files are encrypted on disk.
Hosted in the United States. On Heroku, Fly.io and Cloudflare R2, behind Cloudflare. The subprocessors page lists every provider and what it does.
You decide who gets in. And what they can touch.
People get roles, scripts and agents get keys, and every request is checked against them the same way, wherever it comes from.
Roles for people. Owners, admins, developers, editors and viewers each see and change only what their role allows. Only owners grant ownership, and an organization always keeps one.
Keys scoped to their job. A key belongs to one project, carries only the scopes you grant and, when it is made, never more than its maker's role allows. Keys can expire, and revoking one takes effect at once.
Public keys that are safe to ship. A published-only key reads what your live site shows and nothing else: published records, their assets and the current schema, but no drafts, no history, no schema changes. It is rate-limited per visitor, so a copied key cannot use up your site's budget.
Keys stored as digests. Only a keyed digest of each API key is stored and compared in constant time, so even a copy of our database holds no usable keys.
Leaks you can recognize. Keys start with nohead_sk_ (or nohead_pk_ for published-only keys), so a leaked one is easy to spot, and revoke.
Clean offboarding. Removing someone ends their access with their next request. The access review lists the keys and invitations they left behind, for an admin to revoke.
Search tokens with one job. Public search tokens reach only the published records of collections you open to public search, and the search engine itself enforces it.
Every change accounted for. Every mistake undoable.
Most incidents aren't attacks; they are a bad script on a Tuesday afternoon. The platform is built so that you can see what happened, and put it back.
Attributed and audited. Every change names the person or key that made it, the client it came through and the note it left, and the activity log records who did what.
30 days to change your mind. Records, fields, collections and assets are restorable for 30 days, and deleting a project or an organization waits as long before anything is purged. Purging a deleted asset early, to free its storage, is a deliberate choice.
Redaction when it matters. A value that should never have been saved can be scrubbed from history; the activity log keeps who did it and when.
Backups that are tested. The database is backed up daily, and each quarter a backup is restored and checked. Deleted files are kept for 30 days in storage too.
No passwords to leak. No tokens to steal.
Signing in proves you own your email address, and the session it starts never leaves the browser's cookie jar.
Codes, not passwords. Each sign-in is a six-digit code by email that works once, expires in ten minutes and stops after five wrong tries. Guesses are limited per address too, however many codes are asked for.
No tokens in the browser. The session lives in an httpOnly cookie that page scripts cannot read, and requests made with it must come from the web app itself.
Sessions you can end. A session lasts at most 30 days, or a week unused, and “Sign out everywhere” ends all of yours at once.
A fresh sign-in for what matters. Deleting an account needs a sign-in from the last ten minutes, so a forgotten open session cannot do it.
Nothing to probe. Asking for a code answers the same for every address, so nobody can find out who has an account.
Built defensively. From the edge to the webhook.
Every layer is locked down, and everything that comes from outside, uploads and webhook responses included, is treated as untrusted.
A strict content security policy. The web app and this site run only their own scripts and cannot be framed by another site.
Uploads, contained. Every upload is verified before it becomes an asset. Image renditions leave out location data (the original downloads exactly as uploaded), and no file ever opens as a web page.
Secrets that rotate. Our own signing secrets can be rotated with a window in which the old and new ones both work, so API keys in use carry over and you have time to switch your webhook receivers.
Error reports without your data. Error reports carry no request bodies, cookies, credentials or IP addresses.
Signed webhooks. Every delivery is signed with the Standard Webhooks scheme and a secret per endpoint, which you can rotate.
Webhooks stay on the public internet. Deliveries go only to public https addresses, checked after DNS resolves and never redirected, so they cannot be pointed into a private network.
Secure from the first commit. And every release.
How we build matters as much as what we build, so the practices are part of the process rather than a checklist at the end.
Reviewed and tested. Every change is reviewed before it merges and tested against a real database, with tests for authorization and tenant isolation on every operation.
Secrets kept out of code. Every commit to the platform is scanned for secrets before it is made, and again in CI.
Releases you can verify. The SDKs and the CLI are built and published by CI, with no publishing credentials stored anywhere. npm releases carry provenance, and each needs a person's approval with two-factor authentication.
Reports welcome. If you find a vulnerability, our security policy says how to report it privately. We acknowledge every report within three business days.
Questions, answered.
About access, sign-in, keys, where your data lives and how to report a problem.
Ask us directlyrecords:read or schema:write), never more than their maker's role allows when they are made, can be limited to published records, and can be set to expire. Every change is attributed, and an activity log records who did what, through which client.nohead_sk_ (or nohead_pk_ for published-only keys), so a leaked one is easy to recognize, and only a keyed digest of each is stored, so even a copy of our database holds no usable keys. A published-only key is public by design: it reads what your live site shows and nothing else.Questions from your security team?
Send them over and we will answer every one. On Enterprise, we complete your security review and put it in the contract.