---
title: "Compliance & security"
description: "Where dply runs your apps and data, how it protects them, which subprocessors it uses, and what it doesn't offer yet."
---

This page summarizes how dply handles your code, data and credentials, for teams completing a security review. It describes the platform as it runs today, and matches the public [Security & compliance](/compliance) page. For the controls you configure on your own apps, see [Platform security & isolation](/docs/platform-security).

> [!IMPORTANT]
> dply has no third-party security certifications or audit reports today (for example SOC 2 or ISO 27001), and doesn't offer a HIPAA business associate agreement. Don't host workloads that require them.

## Where your apps and data run

| What | Runs on |
|---|---|
| Static files, SSR, middleware, key-value, Edge SQL, queues, state and object storage | Cloudflare's network (Workers, R2, KV, D1, Queues, Durable Objects) |
| Container apps (PHP, Rails, Node) | Cloudflare Containers, in the region Cloudflare places them |
| Postgres, MySQL, MongoDB and Valkey created by dply | dply's database clusters. See [Data regions](/docs/data-regions) for locations. |
| Builds | dply's build servers |
| Your account, organization, settings and billing records | dply's control plane |

Payments are handled by Stripe. dply never receives or stores your card number.

## Subprocessors

| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare | Hosting, delivery, storage and compute for your apps; DNS and certificates for custom domains; account email | Global network |
| DigitalOcean | dply databases and Valkey stores | New York, USA |
| Stripe | Payments, subscriptions and invoices | Stripe |
| GitHub, GitLab, Bitbucket | Source code access and sign-in, only for the providers you connect | The provider |
| Bunny Fonts (BunnyWay d.o.o.) | Web fonts for the dply website and dashboard. The font request carries the visitor's IP address; Bunny doesn't log it or set cookies. | EU (Slovenia) |

## How dply protects your data

### Accounts

- Sign in with a password, passkeys, or GitHub, GitLab or Bitbucket.
- Two-factor authentication is available on every account. Once enabled, it's required on password and OAuth sign-in. See [Account security](/docs/account-security).
- Access within an organization is governed by roles and per-app membership. See [Roles & permissions](/docs/roles-and-permissions).
- The organization activity log records who changed what. The full audit log and compliance export are part of the Team plan, and entries are kept for 365 days. See [Activity log](/docs/activity-log).

### Secrets and environment variables

- Environment variables, [organization secrets](/docs/secrets), Git provider tokens, Cloudflare credentials, notification channel settings and resource connection strings are encrypted with AES-256 in dply's database.
- The platform's own encryption keys and database backups are escrowed daily to off-site storage with `age` public-key encryption, and a daily drill checks that the newest backup still decrypts.
- Resource credentials, such as database passwords, are generated by dply and injected into your app's environment. You don't need to copy them by hand.

### Builds

Every build is treated as untrusted code. Each build runs in its own container:

- as a non-root user, with every Linux capability dropped and privilege escalation blocked;
- with memory, CPU and process limits;
- on a network that can't reach other builds;
- with only your checkout and your organization's own package caches mounted.

Package caches are never shared between organizations.

### Tenant isolation

Requests are routed by hostname to the deployment of the organization that owns the site, and each app's resources are bound to that app through its own credentials. See [Platform security & isolation](/docs/platform-security).

### In transit

Every site is served over HTTPS. Certificates for custom domains are issued by Cloudflare once the domain is verified. See [Domains](/docs/domains). dply databases and Valkey accept TLS connections only.

### At rest

- Cloudflare encrypts R2, KV and D1 data at rest.
- dply databases and Valkey are stored on DigitalOcean block storage volumes, which DigitalOcean encrypts at rest. Database backups are written to Cloudflare R2.

## Data retention

- **Your data** stays until you delete it. If your organization is paused for non-payment, its apps, resources and data are deleted 30 days after the pause, and we email you before that happens. Data under a legal hold (for example a preservation request) is kept until the hold ends. See [Paused accounts](/docs/paused-accounts).
- **Database backups** for dply Postgres, MySQL and MongoDB are kept for 7 days, and you can restore to any point in that window. Deleting a database deletes its backups. See [Postgres, MySQL & MongoDB](/docs/resources/databases).
- **Request logs** are kept for 7 days. See [Logs](/docs/logs).
- **Your account** can be deleted from **Profile → Delete account**. See [Account security](/docs/account-security).

## Report a vulnerability

Email [security@dply.io](mailto:security@dply.io). Include the affected URL or feature, steps to reproduce, what an attacker could do with it, and how to reach you. Please give us a reasonable time to fix the issue before disclosing it publicly. Test only against accounts and data you own, and don't access, change or delete data that isn't yours. We won't pursue legal action against research done in good faith under these rules. The same contact is published in [`/.well-known/security.txt`](/.well-known/security.txt).

For everything else, including abuse reports, email [hello@dply.io](mailto:hello@dply.io).

## Data processing agreement

The [Data Processing Addendum](/dpa) is part of the [Terms of Service](/terms) and needs no signature. It includes the EU standard contractual clauses (2021) and the UK Addendum. For a countersigned copy, email [hello@dply.io](mailto:hello@dply.io).

## Subprocessor changes

Organization owners are emailed at least 30 days before a new subprocessor is added, and can object under the [Data Processing Addendum](/dpa).

## What isn't available yet

- Security certifications and third-party audit reports.
- Single sign-on (SAML or OIDC) and SCIM provisioning.
- Choosing where your organization's account data is stored.

## Related

- [Platform security & isolation](/docs/platform-security)
- [Account security](/docs/account-security)
- [Data regions](/docs/data-regions)
- [Report abuse](/docs/abuse)