Security, built into every plan
The same protection for a free site as for a busy app: isolated sites, secrets that stay secret, off-site backups and admin tools that never face the internet.
- Where
- London, UK
- In front
- Cloudflare
- Company
- UK, under UK GDPR
Your sites
Every site in its own space
Each site runs in its own container with its own memory, CPU and process limits. One busy or broken site can't slow another down.
Sites can't see each other
A firewall stops sites reaching other sites and our private network. They can still reach the internet, so your database and APIs work.
Builds kept apart
Your code is built on separate build servers that can't reach our private network or other customers' sites.
Behind Cloudflare
Every site sits behind Cloudflare, which blocks attacks before they reach us. Blocked traffic never counts towards your allowance.
Your data
Secrets stay secret
Lock a sensitive environment variable and nobody, including us in the console, can see it again. Build and error logs are cleaned of keys, tokens and passwords before they're stored and again before they're shown.
Backed up off-site
Your account data is backed up continuously, so we can restore it to any moment in the last 14 days, with hourly and daily copies stored off-site and encrypted. Your sites' code is kept in a private store, backed up off-site every hour. We test restoring all of it.
Web Hosting backups
Every Web Hosting account has 30 days of backups you can restore yourself from cPanel.
Cached safely
Cloudflare caches your images, styles and scripts, never your pages, and never anything for a signed-in visitor.
Your account
Sign-in without passwords to steal
Sign in with a link sent to your email, or with Google, GitHub, GitLab or Bitbucket. A bot check guards sign-in, and you can see and sign out your devices.
Roles and a full record
Owners, admins and members each get what their role needs. Activity records who changed what, and when.
AI tools on a short leash
An AI tool you connect works in one workspace you choose. It can't delete sites, see secrets or change plans.
We never see your card
Paddle takes payments as merchant of record. We see the card's brand and last four digits, never the number.
How we run things
Admin tools off the internet
Our servers' admin tools can only be reached over a private network, from devices we've approved.
Watched every minute
We check the console, the AI tool connection, sites and Web Hosting every minute. Our status page shows what we find.
Updates rehearsed first
Security updates are installed promptly, and changes to how a service runs are rehearsed on a copy before they reach yours.
See what's running right now on our status page, and how we handle personal data in our privacy policy.
Found a vulnerability?
Email security@cloudzyro.com with what you found and how to see it. Please give us a chance to fix it before telling anyone else, and don't access other people's data or disrupt our services while testing. We'll reply, keep you posted and thank you once it's fixed.
Harmful content on a site we host, like phishing or malware, is abuse rather than a vulnerability: report it here. Our security.txt has these details for tools.
Need answers for a security review?
Tell us what your team needs to know and we'll go through it with you.