Sign-in
- Invite-only, through Amazon Cognito. Stedhold never sees your password.
- Each app has its own short-lived cookie. Every request re-checks access.
- Guest passes end after 24 hours and carry no identity.
Security
How Stedhold keeps each app private and separate.
Isolation
- Each app runs in its own sandbox with fixed memory and process limits.
- Sandboxes can't reach Stedhold's database or internal network.
- Customer code never runs on the servers that run Stedhold.
Network
- HTTPS everywhere.
- A web application firewall blocks known-bad traffic and rate-limits sign-in.
- A DNS firewall blocks malware, botnet and mining domains from sandboxes.
Data
- Hosted on AWS in US East (Ohio).
- Private settings and keys are encrypted with AES-256-GCM, with the key held outside the database.
- Backups kept 7 days, request logs 90 days, DNS logs 30 days.
Report a problem
- Security issuesecurity@stedhold.com
- Abuse of a hosted appabuse@stedhold.com