Security

This page lists what the platform does today. We don't claim certifications we don't hold.

Transport

• All public endpoints (site, API, MCP, apps) are served over HTTPS; certificates are issued automatically and only for known hosts.
• Nodes connect to the control plane over WireGuard and expose no inbound ports.

Data at rest

• App environment variables are encrypted at rest (Fernet) and never returned by the API.
• API keys and session tokens are stored as SHA-256 hashes.

Isolation

• Each app instance runs in its own container with CPU and memory limits.

Accounts

• HttpOnly, SameSite session cookies; state-changing cookie requests require a CSRF header.
• Single-use, expiring magic links. OAuth 2.1 with PKCE for MCP clients; tokens are scoped and revocable.

Infrastructure

• Phase 1 compute and the control plane run on Hetzner Cloud in Germany and Finland.
• Payments are processed by Stripe; card data never reaches our servers.

Reporting

Email security@aloof.si. Please give us reasonable time to fix an issue before disclosing it.