Built so that one site can never reach another
Isolation is a rule of the platform, not a setting. Below is how it is kept, in plain words.
What is in place
A tenant's host is that tenant only
On your domain only your tenant exists: no other tenant, no platform screens, no platform APIs. A session signed in on your site is bound to it.
Strict content-security policy
The platform's own pages allow only scripts the platform issued, per request. Your pages keep what your own HTML needs.
Host-locked sessions
The session cookie is locked to the exact host by the browser. No sibling site can plant or read one.
Reviewed proxy targets
A proxy to your own application goes live only after a platform review, and can never point at the platform's internals.
Separated networks
Customer applications and the platform core run on separate networks; the database and the admin API are unreachable from a customer container.
Your visitors' addresses, your call
IP addresses are stored, masked or hashed per site, with a retention period you set. Personal information is treated as POPIA asks.
Backups you hold
Nightly platform dumps with an off-host copy, and a daily export of your tenant into your own GitHub repository.
Releases that can retreat
A release switches over only after every site answers on the new copy; the previous copy stays warm for seven days.
Audited, and reviewed
Staff actions are audited. The platform had a performance, security and segregation audit in October 2026 and acted on it.
How a change reaches production
The same lane for every release, measured in minutes, with a way back at each step.
Reviewed and tested
Every change arrives as a pull request with its tests; the suite runs before it merges.
Installed on dev first
The build installs itself on the development copy of the platform, where it is checked against real sites.
Approved by a person
A human approves the tested build; the same image is promoted, never rebuilt.
Switched over, kept warm
Production starts the new copy beside the old, checks every site, switches, and keeps the old copy for seven days.