Keelson

Security & operationsbuilt into every app

Authentication, private ingress, and per-app isolation are built in.These controls reduce blast radius; they do not inspect your app's business logic.

Your app is not directly reachable from the internet

Every request passes through the edge and the authentication gateway before it reaches your app. The private app runtime accepts ingress only from the gateway.

App user browser Edge TLS termination Auth gateway SSO, member check Your app private runtime authenticated requests only Direct access from the internet blocked

Last reviewed: 2026-08-04

Security in one minute

Five points before the details. What each control covers, and where its limits are, is stated in the sections below.

Authentication required

Keelson's authentication is automatically applied to every app. Organization account authentication is required. No auth code needed in your app.

Not exposed to the internet

Private app runtimes accept ingress only from the authenticated gateway. Unauthenticated requests are rejected; there is no inbound path except the gateway.

App isolation

Each app runs in its own VM-isolated runtime with app-scoped data access. Apps cannot directly reach another app's private runtime.

Data location

App runtimes and managed app databases are placed in Tokyo, Japan. Control-plane and operational data may be processed or stored in the United States and other locations.

Authentication logging

Every authentication attempt, successful or failed, is recorded with the user ID, timestamp, and source IP. Auth headers are automatically redacted in the log pipeline.

Logs emitted by your app are not automatically redacted.

Built-in protections

Every app gets the following security features automatically. No code changes required.

Org login

Require organization account authentication, preventing unrestricted access from outside your team.

App isolation

Each app runs in its own VM-isolated runtime with app-scoped data access. Apps cannot directly reach another app's private runtime.

Access control

Control which members can access each app, and restrict access to approved networks with IP allowlisting.

Deployment checks

Candidate revisions must pass a health check before traffic is promoted. Failed candidates do not replace the serving revision.

Monitoring

Selected platform signals are monitored. Application business metrics and in-app health remain your responsibility.

Encryption

Keelson-managed inbound traffic and database connections use TLS. Managed data stores use provider at-rest encryption.

Defense in depth

No single layer to bypass. Authentication, restriction, and isolation are stacked to protect your apps.

External Access
1 Edge (DDoS mitigation / TLS termination)
2 Authentication (SSO)
3 IP Restriction
4 Network Isolation
5 Sandbox Isolation
Your App
1

Edge protection

The global edge provides DDoS mitigation, TLS termination, and routing before requests reach the authenticated gateway.

2

Authentication

Keelson's authentication is automatically applied to every app. SSO via Google and Microsoft accounts, per-app member control. No auth code needed in your app.

3

IP restriction

Allow access only from approved networks. Disallowed networks are blocked before reaching the app runtime. Remote workers can connect through an approved VPN range.

4

Network isolation

Private app runtimes accept ingress only from the authenticated gateway and have no route into the control-plane network. Apps can connect outbound to external services, including another app's authenticated public URL.

5

Sandbox isolation

Each app runs in its own isolated environment with VM-level isolation. Least-privilege principles are enforced, and auth credentials are stripped by the proxy before reaching the app.

Data protection

Managed storage boundaries and recovery limits are stated explicitly.

Encryption

  • At rest — Cloud-standard encryption for disks, databases, and object storage
  • In transit — TLS for Keelson-managed inbound traffic and managed database connections

Deployment safety

  • Health gate — Candidate revisions are checked before traffic promotion
  • Failed deploys — A failed candidate does not replace the serving revision

Storage

  • Managed app databases and saved files persist across deployments
  • Runtime-local disk, including /data, is temporary

How we handle your data

How your data is protected on the Keelson platform.

Data isolation

  • - Data credentials and private runtime ingress are scoped per app
  • - Apps cannot access each other's data
  • - Member access is configured independently for each app

Log privacy

  • - Platform access events record request metadata, not credential values
  • - Error-monitoring events scrub request headers, cookies, and bodies

Logs emitted by your app are not automatically redacted.

Data use

  • - Your data is never used for model training, AI training, or marketing

Data residency

  • - App runtimes and managed app databases are placed in Tokyo, Japan
  • - Account and workspace metadata and some operational data may be processed or stored in the United States, including US West
  • - Edge delivery, identity, logs, artifacts, backups, and object storage may involve other locations
  • - Underlying cloud providers hold SOC 2, ISO 27001, and other certifications

Lifecycle and data requests

  • - After contract termination, customer data may be deleted after the company-defined period, generally within 30 days
  • - Operational logs may be retained where reasonably needed for legal, security, or dispute-resolution purposes
  • - Personal-data access, correction, and deletion requests are handled under the Privacy Policy
Privacy Policy Terms of Service

Shared responsibility model

What Keelson handles, and what you own.

Keelson manages the platform boundary. You manage app code and dependencies, members, secrets, external connections, data classification, retention, and exports.

Authentication & Access

Keelson: Auto-applied auth for all apps, member management

You: Managing member additions and removals

Network

Keelson: Private ingress and control-plane network isolation

You: External destinations and their TLS requirements

Isolation & Permissions

Keelson: Sandbox execution, least-privilege enforcement

Encryption

Keelson: Managed-store at-rest encryption and managed-connection TLS

You: Secret values and TLS for services called by the app

Data lifecycle

Keelson: Managed app data stores

You: Classification, retention, exports, and recovery planning

Infrastructure Ops

Keelson: Managed runtime and deployment health gate

You: App dependencies and in-app monitoring

Application Code

You: Input validation, authorization logic, sensitive data handling

Verifying the logic in AI-generated code (calculation errors, missing authorization checks, etc.) is your responsibility. Keelson defends the outside of your app but does not guarantee behavior inside it.

Boundaries for generated code

Runtime controls limit infrastructure access. They do not validate application logic.

Controlled build boundary

  • - Container source deployments use a runtime-specific Dockerfile generated by Keelson
  • - A Dockerfile supplied in the source archive is not used as the app build definition
  • - The runtime image switches to a non-root user before the app starts

Runtime boundary

  • - Each app runs in a separate VM-isolated runtime with app-scoped credentials
  • - Inbound requests pass through the authenticated gateway; private runtimes are not directly reachable from another app
  • - Keelson does not verify business logic, dependency safety, or the external destinations selected by the app

Operations & incident response

Managed runtime behavior and deployment checks, with explicit customer responsibilities.

Monitoring & runtime behavior

  • - Candidate revisions must pass a health check before traffic promotion
  • - Managed runtimes restart failed instances
  • - Selected platform, billing, and authentication signals are monitored
  • - Application business metrics and in-app health are customer responsibilities

Incident response

  • - Selected platform signals support threshold-based alerts
  • - Platform incident scope covers managed infrastructure and platform components
  • - Managed infrastructure and platform components receive platform-managed updates
  • - Application dependencies are rebuilt only when you deploy

Customer notification

When Keelson becomes aware of a security incident that may affect customer data, affected users are notified within a reasonable period by email, dashboard notice, or another prescribed contact method. Keelson makes commercially reasonable efforts to investigate scope, apply interim measures, and consider recurrence prevention. A fixed recovery time is not guaranteed.

  • - Once we confirm an impact on customer data or availability, we send an initial notice by email to the affected workspace's owners and admins
  • - Until resolution, we send an update at least every 24 hours, including when there is no change in status
  • - Updates end with a resolution notice and a final report summarizing the impact and cause
  • - When a personal-data breach or similar incident triggers a legal reporting duty, we notify the authorities and affected individuals within the period required by applicable law

Managed infrastructure

Keelson manages the runtime infrastructure. Customers remain responsible for application operations and data lifecycle decisions.

  • - No server setup or configuration required
  • - Keelson manages serverless runtime configuration and deployment rollouts
  • - Manage deployments and app settings from the browser dashboard

Infrastructure

  • - Serverless per-app isolated execution environments
  • - Workload isolation between user apps and system components

Security reports

Use the dedicated contacts for vulnerabilities and suspected abuse.

Report a vulnerability

Send the affected component or URL, potential impact, and reproducible steps. The Terms prohibit vulnerability testing, security-control bypass, and access attempts without authorization; contact us before testing systems you do not own.

Report suspected abuse

Report spam, phishing, attack traffic, unlawful content, or other suspected misuse of a Keelson-hosted app. Include the app URL, timestamps, and supporting evidence where available.

Acceptable use & abuse response

The platform boundary includes enforceable limits on misuse.

Prohibited use

The Terms prohibit unauthorized access and vulnerability testing, security-control bypass, container escape attempts, mining, spam, excessive load, and using the service as an attack relay.

Enforcement boundary

Keelson may suspend service immediately for prohibited use and may suspend or terminate an account without prior notice for a Terms violation. An app under abuse suspension is denied at the serving boundary. Keelson does not claim to inspect all application code or outbound traffic for abuse.

Terms of Service, Article 11 Acceptable Use Policy (AUP)

Assurance status

Provider certifications and Keelson assurance are separate.

Infrastructure providers

The cloud infrastructure providers used by Keelson maintain certifications including SOC 2 and ISO 27001. Those certifications cover the providers' services and control environments.

Keelson

Provider certifications do not certify Keelson. Keelson does not claim its own SOC 2 or ISO 27001 certification, or a completed independent penetration test.

Technical details

Authentication
  • -JWT-based authentication (asymmetric key signing and verification)
  • -Google / Microsoft OAuth 2.0 support
  • -Internal proxy session: short-TTL signed tokens
  • -Auth headers and cookies are stripped by the proxy before forwarding to the app
Container Isolation

Each user app runs in its own VM-isolated execution environment.

  • -Dedicated per-app environment with VM-level isolation — no sharing with other apps
  • -Runs as a non-root user with privilege escalation disabled
  • -Operates under a dedicated least-privilege identity — its storage permissions are scoped to the app's own data area, with no access to other workspaces' or apps' data
  • -Any platform-issued credential injected into the container is scoped to that app and to a single capability — for example its own storage, its own database, its own email token, its own directory token — and no control-plane or administrative credentials are passed
Network
  • -Ingress: Apps reachable only via the authenticated gateway; unauthenticated requests are rejected
  • -Egress: Apps may connect directly to external services, including another app's authenticated public URL
  • -No route from app runtimes into the control-plane network
Encryption
  • -At rest: Cloud-standard encryption — disks, databases, object storage
  • -In transit: TLS for Keelson-managed inbound traffic and managed database connections
Infrastructure
  • -Serverless per-app isolated execution environments
  • -Edge network: DDoS mitigation + TLS termination
  • -Platform database: private networking, automated backups, point-in-time recovery, single-region deployment
  • -Per-app isolation: each app runs separately from other apps and system components
  • -Fully managed runtime — no servers to patch or maintain
  • -Network-isolated execution: no inbound path except the authenticated gateway
Logs & Monitoring
  • -Metrics-based resource monitoring
  • -Access events omit credential values; error-monitoring events scrub request headers, cookies, and bodies
  • -Logs emitted by application code are not automatically redacted
  • -Selected platform signals support threshold-based alerts
Compliance
  • -Keelson's cloud infrastructure providers hold SOC 2, ISO 27001, and other certifications
  • -App runtimes and managed app databases are placed in Tokyo; control-plane and operational data may be processed or stored in the United States and other locations

Vulnerability disclosure

We welcome good-faith reports that follow this vulnerability disclosure policy.

Authorized scope

You may research workspaces belonging to your own account, apps owned by those workspaces, and endpoints of your own apps on *.keelson.run.

Out of scope are other workspaces' apps and data; automated scanning or brute-force attempts against the control plane (api.keelson.dev and console.keelson.dev); services operated by our external providers; and our employees, offices, and physical facilities, including social engineering.

Prohibited methods and stopping

Do not perform load testing or denial-of-service attacks, send spam, obtain, alter, or delete another person's data, impair service availability, or evade monitoring.

If you discover that you may be able to access another workspace's data, stop immediately. Do not retain any obtained data, and keep only the minimum evidence needed for your report.

Reporting and response

Report the affected component or URL, potential impact, and reproducible steps to security@keelson.dev.

We will provide an initial response within 3 business days of receipt, based on business days in Japan. We do not promise a remediation deadline.

Safe harbor

Research performed within this disclosure policy is deemed to have our prior authorization under AUP §2.1. The prohibitions in AUP §2.1 continue to apply to conduct outside its scope.

We will not take legal action regarding research that is conducted in good faith within the scope above, does not affect availability or another workspace's data, is reported promptly after discovery, and is not disclosed publicly until remediation is complete.

We do not offer monetary rewards or a bug bounty.

Backup and recovery

Customer app data and Keelson platform data have separate backup and recovery boundaries.

Customer app data

  • - Daily backups, manual backups, point-in-time recovery, and downloads are available for managed app databases
  • - You are responsible for recovery planning, including selecting the restore point and verifying application-level consistency

Platform data

  • - The platform database uses private connectivity, automated backups, and point-in-time recovery; it is deployed in a single region
  • - We do not publish numerical recovery time or recovery point objectives

Data handling by category

Data locations and retention vary by category and operational role. Service-provider names are not listed here.

App data (Managed SQLite contents and app files)

Primary region: Managed app databases are placed in Tokyo, Japan; no single primary region is specified for app files

Other regions: Edge delivery, artifacts, backups, and object storage may involve other locations

Retention: Kept while the service is provided; after contract termination, it may be deleted after the company-defined period, generally within 30 days

Account, workspace, and app management information (metadata)

Primary region: No single primary region is specified for this category

Other regions: Some metadata may be processed or stored in the United States, including US West; identity and edge delivery may involve other locations

Retention: Kept for the period needed to fulfill its purpose, then deleted or anonymized when no longer needed

Operational and audit logs

Primary region: No single primary region is specified for this category

Other regions: Some operational data may be processed or stored in the United States, including US West; logging and edge delivery may involve other locations

Retention: May be kept for a reasonable period when needed for legal compliance, security, or dispute resolution

App runtime logs

Primary region: No single primary region is specified for this category

Other regions: Logging may involve other locations

Retention: Available for querying within the applicable plan's window; this window is not a physical deletion deadline, and no physical retention period is publicly committed

Billing information

Primary region: No single primary region is specified for this category

Other regions: Payment processing may take place outside Japan, including in the United States; Keelson does not retain full credit-card details

Retention: Kept for the period needed for payment and legal purposes, then deleted or anonymized when no longer needed

Deploy your first authenticated app today

Authentication, private ingress, per-app isolation, and managed infrastructure controls are included in every plan.

View pricing | How Keelson works