Security
Everything on this page is live in production right now, and it lists shipped behaviour only. Gemmein publishes its security guarantees, meaning what you are protected from, and withholds the mechanics of how each protection works, because publishing the internals would tell attackers exactly what to work around. That is why some details are missing here. Security researchers can always reach us at abuse@gemmein.com or report a security finding.
Other platforms sell the safe version back to you as an enterprise tier. Gemmein can't do that, because safety is the product. Every one of these guarantees holds for every app, including free ones, and each one is already configured for you.
Every request to your app passes through multiple independent layers of defence before it ever reaches your data. Abuse, floods, and known attack traffic are absorbed and filtered before they can touch anything of yours.
One app cannot see another app's users or data, and a production environment cannot leak into a development one. The platform enforces this itself: every read and write is scoped to one app and one environment by the API and again by the database's own row rules, so it does not depend on app code.
The systems that hold your data are not reachable from the internet at all. The only network route to them is through the API itself. There is nothing exposed for an attacker to find.
Your users sign in with a one-time email code. There is no password database to breach, no password reset flow to abuse, and no stolen-password list that can be replayed against your app.
Data is encrypted on its way to us and encrypted where it's stored. There is no unencrypted path and no unencrypted copy.
Sign-in abuse, scraping, and traffic spikes are throttled automatically. The limits an app must design around are documented for developers; the other thresholds are not published, because attackers tune their behaviour to numbers they know.
Hosting, scaling, patching, and backups are handled by the platform. You never provision, patch, or monitor a server, and routine protection never depends on you remembering to do something.
Users sign in with a short-lived email code. That is the whole model, and it removes an entire category of breach before it can happen.
Sign-in codes are unguessable and short-lived. Even we never keep a usable copy, so there is nothing on our side worth stealing.
Sessions expire on their own, end immediately on logout, and can't be carried from one app to another. A session for one app is worthless everywhere else.
Tenant isolation is the single most important property of a multi-tenant backend, so Gemmein enforces it more than once, in more than one place.
Every piece of data belongs to exactly one app and one environment. The boundary is enforced independently in the API and in the database's row-level rules.
In private collections, each user sees only what belongs to them. Identity is decided by the server, so a browser cannot claim to be someone else.
Uploaded files are checked, size-limited, and delivered from storage on its own origin with the content type and disposition Gemmein sets — never from your app's own address — so a file is not run as part of the app.
All payment processing is handled end to end by a dedicated payment provider. Card numbers are never transmitted, processed, or stored on our infrastructure.
Deleting a record, a collection, or an app comes with a recovery window, so no structural mistake is one keystroke from permanent. Nothing important can be dropped by accident, including by us.
When a user asks to be deleted, they are deleted. Account deletion is a hard delete, and the details are in our privacy policy.
Sign-ins, data changes and management changes are all recorded, including the ones that were refused.
The trail survives tampering
Logs never contain secrets, credentials, or your users' message contents, and the trail is kept in more than one place, independently, so no single compromise can erase the evidence. The platform is watched around the clock by automated monitoring that pages an on-call person.
Gemmein's controls follow OWASP, NIST, and ISO 27001 guidance. Gemmein has not been audited for certification against any of these standards, which is why this page says aligned.
The platform went through a full security review before launch. Every finding was fixed and re-verified, and the review never stopped: security claims are continuously re-checked against the actual code, and automated security tests guard against regressions on every change.
We say “aligned”, never “certified”. The security review was our own, and no outside auditor has certified Gemmein. If a claim on this page ever stops being true, it comes off the page.
If you've found a security vulnerability or have a concern about how Gemmein handles data, we want to hear about it. Reports are read by a person, and you will hear back.
abuse@gemmein.comFor privacy-related questions: privacy@gemmein.com