Security and data protection

What protects your builds, your account, your data and your visitors, with the setting behind each claim. And what we do not have yet.

Your builds

Your code runs on our machines, next to other people's. Each build gets a fresh container of its own that can do very little, and it is removed after the build.

Every build container, as we run it
  1. activeDeadlineSeconds: 930 15 minutes plus 30 s on Free; 1830 (30 minutes plus 30 s) on paid plans.
  2. backoffLimit: 0
  3. automountServiceAccountToken: false No key to our cluster.
  4. securityContext:
  5. runAsNonRoot: true
  6. runAsUser: 1000 Never root.
  7. allowPrivilegeEscalation: false
  8. capabilities:
  9. drop: [ALL] No Linux capabilities.
  10. resources:
  11. limits:
  12. cpu: 1500m
  13. memory: 4Gi One build cannot starve another.

  • Install scripts off

    Dependencies install without running their install scripts, so a compromised package cannot run code while it installs.

    npm ci --ignore-scripts

  • Web traffic only

    Outbound, a build gets web traffic on ports 80 and 443 and name lookups, nothing more. Its environment variables arrive in a secret that is deleted with the build.

    egress: 80, 443 · DNS

Your account and team

Sign-in runs on our own servers, not on a third party's. Roles decide who can change what, and keys can never do more than a member.

  • Our own sign-in

    Zitadel, self-hosted in Paris. Your account password is held only there, never in our application database.

    OIDC with PKCE

  • Passkeys and authenticator apps

    Add a passkey or a one-time code app to your account from the security settings.

    WebAuthn · TOTP

  • Four roles

    Owner, admin, member and viewer. Domains and deleting a project need an admin; plans and payment need the owner.

    owner · admin · member · viewer

  • API keys capped

    Keys are stored only as a hash and act as a member at most, so a leaked key can deploy but never delete a project or touch billing.

    dbk_… · SHA-256 · member

  • Single sign-on

    Connect your own OpenID Connect provider, such as Keycloak or Authentik, on every plan. In beta.

    OIDC

  • No CAPTCHA

    Signup is guarded by a proof-of-work check we issue and verify ourselves. No Google, Cloudflare or hCaptcha.

    ALTCHA, self-verified

Your data

Everything stays in the EU, every request is scoped to your team, and the secrets you give us are encrypted before they are stored.

  • Secrets encrypted

    Environment variables, Git tokens and single sign-on secrets are encrypted before storage. The key lives in Scaleway Secret Manager, not in the database.

    AES-256-GCM

  • Team by team

    Every request is scoped to your team, and dozens of automated tests check that one team cannot reach another's data.

    team_id on every query

  • Kept in the EU

    Builds, data and sign-in run in Paris, and every company that can touch your data is named and headquartered in the EU.

    Scaleway fr-par

  • Rate limits

    Requests are limited per team when signed in and per address otherwise, so one caller cannot drown out the rest.

    per team · per IP

Your visitors

The people who visit your site get modern encryption, and you decide which countries can reach your domain.

  • Modern TLS only

    Every address we serve refuses connections older than TLS 1.2 and redirects plain HTTP to HTTPS, and certificates renew on their own.

    TLS ≥ 1.2 · HTTPS only

  • Security headers by default

    Every response from your site tells browsers to keep using HTTPS, to trust the file types it is sent with, and to share only your domain with other sites. Your _headers file can change any of them.

    HSTS · nosniff · Referrer-Policy

  • Requests answered in the EEA

    Visitor requests are answered only by CDN edge locations in the EU, Iceland and Norway, wherever the visitor is. A custom domain can opt in to worldwide delivery.

    EEA only by default

  • Country filtering

    Allow or block visitors by country on your custom domain. This decides who can visit, not where their requests are answered.

    allow list · block list

  • Form spam held, not dropped

    Suspected spam sent through deploybase forms goes to a quarantine you can review, never silently away.

    inbox · quarantine

  • How we measure our own site

    Our site and dashboard use Umami, self-hosted in Germany, without cookies, and respecting Do Not Track. No advertising cookies, no third-party trackers.

    Umami · no cookies

Found a vulnerability? Tell us.

Write to security@deploybase.eu. We will not take legal action against anyone who acts in good faith, follows responsible disclosure and gives us reasonable time to fix it.

We confirm your report
3business days
We fix critical issues
14days
deploybase.eu/.well-known/security.txt
Contact: mailto:security@deploybase.eu
Expires: 2027-04-06T00:00:00.000Z
Preferred-Languages: en, nl
Canonical: https://deploybase.eu/.well-known/security.txt
Policy: https://deploybase.eu/security#vulnerability-disclosure

The documents behind this page

Last updated 17 October 2026.

What we do not have yet.

  • A certification of our own No SOC 2 or ISO 27001 for deploybase itself yet, and no external penetration test. The data centres we run in are ISO/IEC 27001 certified.
  • Required two-factor or SSO Members can add a passkey or an authenticator app, but a team cannot require it, or require single sign-on, yet.
  • A team audit log There is no log of who in your team changed what.
  • SAML and SCIM Single sign-on is OpenID Connect only, and members are not provisioned from your directory.

Questions about security.

Something else? Write to support@deploybase.eu. A person answers.

What happens if there is a data breach?

We notify affected customers within 48 hours of becoming aware of it, as our data processing agreement commits, and say what we know so far. For data we control ourselves, such as account data, we notify the Dutch data protection authority, the Autoriteit Persoonsgegevens, within 72 hours unless the breach is unlikely to put anyone at risk, as the GDPR requires.

Data processing agreement
Is there a data processing agreement?

Yes, on every plan, the free plan included. It is part of the terms, so there is nothing to request or sign.

Read the DPA
Has deploybase been audited?

We review our own code for security, most recently in September 2026, and work through what we find. There has been no external penetration test yet, and we hold no certification of our own. Our infrastructure provider, Scaleway, is certified to ISO/IEC 27001.

Do you use my data to train AI?

No. We do not train models on your code, your sites or your data, and we do not sell them.

Which companies can access my data?

Four EU-headquartered subprocessors, each named with what they do and where. We tell customers at least 30 days before adding one.

Subprocessors

Security and compliance questions go to security@deploybase.eu, everything else to support@deploybase.eu.

Host it somewhere you can check.

Create a team on the free plan. The DPA is already included.

Start free Talk to the founder