Security
Last updated: October 4, 2026
Encrypted in transit and at rest
API traffic and database connections use TLS. Databases, backups and file storage are encrypted at rest on AWS.
Isolated per app
Every app gets its own Postgres database and roles, its own function runtime and its own credentials.
Row-level security in Postgres
Policies are enforced by the database on every request, even for table owners, and instancez warns about tables with RLS off.
Encrypted, write-only secrets
App secrets are sealed with AES-256-GCM under a per-app key. Once saved, only the last four characters are ever shown.
Auth that resists takeover
bcrypt-hashed passwords, refresh tokens that rotate and revoke the session on reuse, TOTP MFA, and signing keys you can rotate.
Private files stay private
Storage objects follow the same RLS rules, with signed URLs, per-bucket size limits and allowed file types.
Point-in-time recovery
Continuous WAL archiving plus a daily base backup, kept for 7 days, so the database can be restored to a moment in that window.
Open source, self-hostable
The runtime is Apache-2.0. Read the code, or run the same binary on your own servers for full control over where data lives.
Hosting
Hosted projects run on AWS in us-east-1. If you need data in another region or inside your own network, self-host the runtime against your own Postgres.
Reporting a vulnerability
Please don’t open a public issue. Report it privately through GitHub’s private vulnerability reporting on the instancez repository, with steps to reproduce and the version you tested. We aim to acknowledge reports within a few business days, keep you updated while we fix it, and credit you in the advisory unless you’d rather we didn’t. The full policy is in SECURITY.md.