Security on every plan

Isolation between apps, and between one person's data and another's, is checked by the platform itself on every read and write — never left to your app's own code. See Strict tenant isolation, below.

Every Live change your AI proposes waits for you to approve it in your own browser — never automatic, never from a chat. See Your Gemmein account, below.

A Live secret key is made only when you approve it, shown to you that one time, and never sent to your AI. See Live secret keys never reach your AI, below.

Sign-ins, data changes and management changes are all recorded, including refused ones, kept in more than one place so no single compromise can erase it. See Audit logs, below.

Every request to your app passes through multiple independent layers of defence before it reaches your data. Abuse, floods and known attack traffic are filtered out before they touch anything of yours.

One app cannot see another app's people or data, and an app's Live environment cannot leak into its Development environment. The platform enforces this itself. Every read and write is scoped to one app and one environment, first by the API and again by the database's row-level rules, so isolation does not depend on your app's code.

The systems that hold your data are not reachable from the internet. The only network route to them is through the API.

Data is encrypted on its way to us and where it is stored. There is no unencrypted path and no unencrypted copy.

Sign-in abuse, scraping and traffic spikes are throttled automatically. The limits your app must design around are documented for developers. Other thresholds are kept private, because attackers tune their behaviour to numbers they know.

Hosting, scaling, patching and backups are handled by the platform. You never provision, patch or monitor a server, and routine protection never depends on you remembering to do something.

Sign-in codes are unguessable and short-lived. Gemmein does not keep a usable copy of any code.

Sessions expire on their own and end immediately when a person signs out. A person can see every device they are signed in on, sign one out or sign out everywhere, and is emailed when a new device or country signs in. A session works only in the app that created it and cannot be carried to another app. Your own dashboard holds one session at a time, and every Live action your coding agent asks for needs your approval in the browser.

You sign in to the dashboard with an emailed code, and you can add an authenticator app as an independent second factor: a 6-digit code that changes every 30 seconds, asked for after the emailed code. You turn it on in Settings → Security. Every Live change to how your business runs (a promote or Live push, products and prices, a domain, email sending, Stripe, keys, deleting a collection, relay or AI tool, taking the Live site offline), whether you make it on the dashboard or approve it for your AI, asks for a fresh code, and so do deleting your account and turning the code off. A change to one customer, such as giving credits, is your approval alone. Going live is your approval, then your plan's payment. Ten wrong codes in a row slow the next try, from a minute up to a day, and never lock you out. Ten single-use recovery codes work in its place, and a lost phone is checked by our support team by hand.

Your AI builds in Development. A Live secret key is made only when you approve it in your browser, and it is shown to you there once, so your AI never receives one. Each change to Live waits for your approval, and each approval covers that one action. Every secret key and function secret is encrypted on its own (AES-256), with the encryption keys held in AWS's key-management service. Every use is logged, and anything that looks like misuse — a read from outside Gemmein's own servers, or an unusual volume of it — raises an alarm.

In private collections, each person sees only the records that belong to them. The server decides who is signed in, so a browser cannot claim to be someone else.

Uploaded files are checked and size-limited. They are served from a separate storage origin, never from your app's address, with a content type and disposition Gemmein sets. A file is not run as part of your app.

All payment processing is handled end to end by a dedicated payment provider. Card numbers are never transmitted, processed or stored on our infrastructure. The Stripe key Gemmein holds for your app is a restricted key that can’t pay out, refund, or read cards.

Deleting a record, a collection or an app starts a recovery window, so a mistake is not permanent the moment it is made.

When a person asks for their account to be deleted, it is hard-deleted. The details are in our privacy policy.

The platform went through a full security review before launch. Every finding was fixed and re-verified. Automated security tests run on every change, and each claim on this page is re-checked against the running code. A claim that stops being true is removed from the page.