Security
Separation, HTTPS, and secrets that never touch a repository.
This page says what we do, and equally what we do not promise. Security claims are only worth as much as the honesty behind them, so ours are deliberately narrow.
Isolation
Every application runs in its own container on a shared machine. Containers do not share a file system or a process, and one application cannot read another's environment variables or database. Your data is your application's data.
The management console that runs the platform holds no database credential and no payment detail. It talks to the machines over an operator API token, so a compromise of the console cannot reach the money tables directly.
HTTPS
Every application is served over HTTPS from its first deploy, at yourapp-yourlogin.dormhost.app or on a custom domain pointed through your own Cloudflare. Cloudflare sits in front for DNS and DDoS protection. The origin serves traffic to Cloudflare over a private link, and the certificate your visitors see is issued and renewed at the edge.
Credentials
- We connect to GitHub with a deploy token we can remove at any time, never with your password.
- Environment variables live in the dashboard, are injected when the app starts, and never appear in build logs or the repository.
- Payments are handled by PayU. We never see or store your card or UPI details.
- The AI API uses its own key, scoped to the balance on your account.
Data and backups
Awake keeps a nightly backup of your storage, your database and your settings, held for 7 days and restorable from the dashboard. Nap keeps one backup you take yourself, whenever you want one.
The storage allowance is a ceiling, not a reservation, and it covers everything the application owns: your code, the files it writes, your uploads and your database, counted together. If your balance runs out we keep everything for 30 days, or 7 days if you have never added credit of your own. We email you before anything is deleted, and adding credit at any point stops it.
Abuse
The price only works if the machines stay mostly idle and the IP addresses stay clean, so we are firm about what we host. Mining, phishing, spam, proxies and the rest are listed in the acceptable use policy and are not sold at any price.
Responsible disclosure
Found something? Tell us at [email protected] before telling the world, and we will take it seriously. This is a small platform run by one person, so please be patient: there is no bug bounty budget, but a real report gets a real reply and a real fix.
Worried about something specific? Write to [email protected] and ask. You will get a straight answer about what we can and cannot promise.