Legal

Security

Last updated 24 October 2026

How datahuru keeps your apps and data safe, and how to tell us when you find a weakness. If you think you have found one, write to security@datahuru.com.

How we protect your apps and data

Your apps are kept apart from everyone else's. Each app runs in its own isolated space. Other customers' apps cannot connect to it, and it cannot connect to theirs, to our servers' internal network, or to the systems that run datahuru. It reaches the internet, and your own team's apps.
Containers run locked down. Every app runs as an unprivileged user, with no administrative capabilities, a read-only file system and a restricted set of system calls. There is no way to ask for more, for any app.
Builds are contained. Your code is built without root privileges, in a space nothing can connect to. Repositories are fetched over HTTPS only.
Our servers are closed. From the internet, they answer only on the web ports, 80 and 443, and to our own servers in other regions on the few ports that join them. Administrative access is by key only, from named addresses, and repeated failed attempts are blocked. Traffic between our servers, in one place or between regions, is encrypted with WireGuard, and security updates are installed daily.
Secrets are encrypted. Variables you mark secret are encrypted with AES-256 before they are stored, and never shown again.
Traffic is encrypted. The dashboard, this website and every app's address are served over HTTPS, with certificates issued and renewed automatically.
Sign-in is safe by default. Sign-in links work once and expire after 15 minutes. Passwords are stored only as Argon2id hashes. Sign-in attempts are rate-limited, and the sign-in page does not reveal whether an address has an account.
Our access is limited and recorded. Only named staff can reach the platform's administration, and when they open your dashboard to help you, it is shown to them on every page and recorded on your account.
Your data is backed up. Each app, its databases and their data are hosted in the region your team chose for it: today, Hetzner's data centre in Germany, with servers in Tanzania joining as a region of their own. The platform's database is replicated as it is written and backed up continuously; volumes are backed up daily. Backups are kept in the European Union.

How we handle personal data is in the privacy policy and data protection.

Reporting a vulnerability

Write to security@datahuru.com with what you found, how to reproduce it, and what it lets someone do. Screenshots, requests and proof-of-concept code help. Please do not include anybody else's personal data.

We acknowledge reports within to be confirmed and keep you told how the fix is going. When it is fixed, we say so, and, if you would like, thank you by name.

In scope

The dashboard at app.datahuru.com, and this website.
Apps' own addresses at *.datahuru.com, as far as the platform serves them.
Isolation between customers: reaching another customer's app, data, secrets or builds, or the platform itself, from your own app or build.
Billing and payments: changing a balance, a charge or a top-up you should not be able to.

Out of scope

Weaknesses in apps our customers deploy: report those to them.
Denial of service, load testing, and anything that degrades the service for others.
Social engineering, phishing, and physical attacks on our staff or data centres.
Reports from automated scanners without a demonstrated impact, missing headers without one, and self-XSS.

Safe harbour

If you act in good faith under this policy, we will not take legal action against you or report you for it. That means: test only against accounts you own or have permission to use; stop as soon as you reach data that is not yours, and do not keep or share it; do not disrupt the service or other customers; and give us reasonable time to fix a problem before telling anyone else about it.

The address to write to is also published in security.txt.