Security Policies

At Appocado, protecting application infrastructure, multi-tenant databases, and creator workspaces is built into every layer of our platform. Below are the key security principles, runtime safeguards, and compliance controls enforced across all hosted applications.

1. Multi-Tenant Runtime & Subdomain Isolation

Appocado hosts thousands of applications across custom subdomains (e.g. store-app.appocado.dev). Security isolation is maintained at every layer:

• Strict Tenant Scoping: Memory spaces, database connections, and asset containers are strictly segregated by workspace ID. One tenant's code execution can never cross into or read another tenant's memory.
• Preserved Hostname Resolution: Hostname verification logic ensures multi-tenant subdomains resolve accurately at the edge prior to script evaluation, preventing cross-tenant URL spoofing or subdomain truncation.

2. Data Encryption Standards

• In-Transit Encryption: All traffic between end-users, Appocado subdomains, and builder APIs is forced through TLS 1.3 protocol encryption with automatic SSL certificate renewal.
• At-Rest Encryption: Database files, application assets, user tables, and backup snapshots are encrypted using industry-standard AES-256 encryption.

3. In-App AI Copilot Sandbox & Guardrails

Every generated app includes an embedded AI assistant. Security guardrails prevent AI prompt injection and unauthorized actions:

• Scoped Database Permissions: In-App AI Assistants operate under strict read/write scope permissions designated by the App Creator. They cannot access system tables or admin platform keys.
• Context Isolation: End-user conversations with the AI Copilot are isolated per app instance and never shared across different hosted projects.

4. Infrastructure Protection & Rate Limiting

• DDoS Mitigation: Edge routing filters suspicious automated traffic and volumetric attacks before reaching hosted application instances.
• API Rate Limiting: Standard rate limits protect builder APIs and hosted app endpoints against brute-force login attempts and resource exhaustion.

5. Continuous Backups & Automated Disaster Recovery

• Automated Snapshots: Database schemas and project versions are snapshotted automatically across distributed edge locations.
• Instant Rollback: Creators can instantly revert to previous working versions of their application code or database state directly from the Appocado dashboard.

6. Vulnerability Management & Reporting

We actively monitor our platform dependencies and conduct routine vulnerability audits. Security researchers and community members can submit security findings directly to security@appocado.dev.