Security & ownership
Almost nobody publishes this page. Here is exactly how we hold your keys, what we can and cannot see, and the gate every app passes before it goes live.
How we hold your keys
When you connect a service, your key is encrypted immediately — before it is stored — using envelope encryption: each key gets its own fresh encryption key, which is itself locked by a master key that never sits in the database. The pieces are bound to your account, your project, and that specific service, so a stolen ciphertext is useless anywhere else.
Your key is decrypted only in server memory, only at the moment it is used, and wiped after. It is never written to logs (our logging layer actively redacts anything shaped like a secret), never shown in any error message, and never sent to any browser — including yours. What you see in the app is the last four characters, nothing more.
The build sandbox never receives your keys at all. When a build step needs one — say, deploying to your Railway — the build agent asks our server to do that one action, the server does it with the decrypted key, and only the result goes back to the sandbox.
Disconnect = destroy
Hitting “Disconnect” on any service hard-deletes the encrypted key and its unlock key in one stroke — crypto-shredding. There is no backup copy, no soft-delete, no recovery. If you reconnect later, you paste a fresh key. We recommend also revoking the old key at the service, which takes one click.
The security gate
Deployment is refused — not warned, refused — while any of these are true: a database table with user data is open to the public; anything shaped like a secret sits in the code; the app serves without a login where the plan requires one; the app has no health check. The gate verifies behavior with real requests against your app, not a checklist. The message is always plain: “I won’t put this live yet — here’s why. Fixing it now.”
The no-meter pledge
We never bill you for AI usage, and we never will. Builds run on your own Anthropic account, billed by Anthropic to you — typically $150–275 to build your app and put it live, then $150–700 for the changes you ask for after that, with an estimate before every build and a live meter during it. Set a monthly spend cap on your Anthropic workspace and it becomes structurally impossible to overspend. A platform that profits from retries has no incentive to get it right the first time; we made that impossible on purpose.
What we store, what we can’t read
We store your account, your projects, your interview conversations, your blueprints, and your encrypted keys (which we can technically decrypt only inside the server at the moment of use — and never expose). Your app’s own data — customers, orders, whatever it tracks — lives in YOUR database on YOUR account. We never copy it and cannot see it unless you choose to hand us a key for a support request.