We are not SOC 2 certified yet — here is exactly what we do, verified by an automated security test suite that runs on every change.
Default-private
Every app you put online is visible to exactly one person: you. Sharing is an explicit act. There is no accidental public link.
Every request to an app goes through our gateway first. You must be signed in and on the app's share list before a single byte of app code runs. There is no code path from a URL to an app that skips this check — that exact property is what our test suite asserts.
Revocation is instant
Access is checked on every single request. Remove someone and they're out on their very next click.
Permissions are never cached in your session. Every single request looks up the share list fresh — revocation is instant, not “within 24 hours”.
Secrets never in your code
API keys go in a settings panel, not your code. Your app gets them only when it runs — they never appear in your code, your git history, or anyone's browser dev tools.
Secret values are written only to Cloudflare's encrypted secret store and injected into your app at runtime. Our database stores key names only. Secret values never appear in our logs, API responses, or dashboard — once written, they cannot be read back out through artifacted at all.
Every app runs in its own sandbox
Apps run as isolated Cloudflare workers — the same worker isolation used by platforms like Shopify to run untrusted code. Your app cannot read another app's code, data, or secrets, and one user's app cannot call another user's app with borrowed credentials: forwarded requests carry no platform identity.
Your artifacted session is invisible to apps
The cookie that keeps you signed in to artifacted is stripped from every request before it reaches an app, and apps cannot overwrite it. An app you visit never sees — and can never steal — your platform session.
An app's data belongs to that app
Apps can save small pieces of shared data through their built-in storage. Our gateway answers those requests itself, after the same access check as the app — so only people the app is shared with can reach its data, and an app can never read or write another app's data.
Errors don't leak
When an app crashes, visitors get a branded error page. Stack traces and internal details never reach the browser.
Subprocessors and data location
- Cloudflare
Hosting, database, secret store. All data lives on Cloudflare's global network.
- Google
Sign-in only.
- Microsoft
Sign-in only.
- Resend
Transactional email — share invitations and app notifications. Receives recipient email addresses only.
Found something?
If you believe you've found a security issue, email contact@artifacted.cloud and we'll respond quickly. Please don't test against other people's apps or data.
Prefer to talk it through? Book 30 minutes.
Everything above describes what artifacted does today. When something changes, this page changes with it.
Deploy an app