artifacted

Security

Last updated: 24 July 2026

We are not SOC 2 certified yet — here is exactly what we do, verified by an automated security test suite that runs on every change.

Private by default

Every request to an app goes through our gateway first. You must be signed in and on the app's share list before a single byte of app code runs. There is no code path from a URL to an app that skips this check — that exact property is what our test suite asserts.

Access is re-checked on every request

Permissions are never cached in your session. Every single request looks up the share list fresh, so removing someone locks them out on their very next click — revocation is instant, not "within 24 hours".

Secrets never live in your code — or our database

API keys you add are written only to Cloudflare's encrypted secret store and injected into your app at runtime. Our database stores key names only. Secret values never appear in our logs, API responses, or dashboard — once written, they cannot be read back out through artifacted at all.

Every app runs in its own sandbox

Apps run as isolated Cloudflare workers — the same worker isolation used by platforms like Shopify to run untrusted code. Your app cannot read another app's code, data, or secrets, and one user's app cannot call another user's app with borrowed credentials: forwarded requests carry no platform identity.

Your artifacted session is invisible to apps

The cookie that keeps you signed in to artifacted is stripped from every request before it reaches an app, and apps cannot overwrite it. An app you visit never sees — and can never steal — your platform session.

Errors don't leak

When an app crashes, visitors get a branded error page. Stack traces and internal details never reach the browser.

Subprocessors and data location

Found something?

If you believe you've found a security issue, email [FOUNDER: contact email] and we'll respond quickly. Please don't test against other people's apps or data.