Have Questions?

How your app is protected

You shouldn’t need to become a security person to put something online — that’s the part you’re paying us for. But “trust us” isn’t an answer, so here is what actually stands between your app and a bad day, in plain English.

The building your app lives in

Every app we launch runs in a data center in New York operated by one of the largest cloud companies in the world — the same kind of building the apps already on your phone live in. We don’t name them here, because names change and promises shouldn’t; email us and a person will tell you.

Independent auditors regularly inspect that facility — everything from who can badge through which door to how power, cooling and data are handled — and certify it against these standards:

  • ISO 27001 The big one for security: an audited management system for how servers, data, and the people who touch them are kept safe.
  • SOC 2 Type II An outside auditor watched the security, availability and confidentiality controls actually working — over months, not on one good day.
  • SOC 1 Type II The same months-long audit, applied to the controls that protect financial information.
  • PCI-DSS The payment-card industry’s standard for any place card data could pass through.
  • ISO 22301 A written, rehearsed plan for the bad day — power cuts, storms, surprises — so things keep running anyway.
  • ISO 9001 Quality management: there’s a documented right way to do everything, and someone checks it’s followed.
  • ISO 14001 Environmental management — the facility measures and minds its footprint.
  • ISO 45001 Health and safety for the people who work inside it.
  • ISO 50001 Energy management — power is used carefully, and measured.

These certifications belong to the data-center operator, and that’s the point: the people whose entire business is running buildings full of servers are independently audited for it, so nobody has to take anyone’s word.

How we run your server

A safe building doesn’t make your app safe — that part is ours. All of this is true of every server we hand you:

  • Keys, not passwords You can’t sign in to your server with a password, because there isn’t one to guess. Entry is by cryptographic key — nothing to phish, nothing to brute-force. Our platform verifies this on every server instead of assuming it.
  • One customer per server Your app runs on a server of its own, under an account of its own. Nobody else’s code, nobody else’s traffic, nobody else’s problems.
  • A firewall that defaults to no Every server starts life refusing all incoming traffic except the kind your app is actually there to serve.
  • The background noise, turned away The internet’s constant probing — vulnerability scanners, break-in bots, the greatest hits of known attacks — is rejected at the front door, before any of it reaches your code.
  • Security fixes that install themselves The server’s operating system takes its security updates automatically, every day. Nothing waits for a human to remember.
  • Copies encrypted before they travel The daily copy of everything is encrypted on your server (AES-256) before it leaves, and stored with a separate company in a separate place. The credentials that write it can see your backups and nobody else’s.
  • A scanner that never sleeps Every server carries a malware scanner with tens of thousands of known-attack signatures, refreshed daily. Anything it flags is reviewed by a human — not auto-deleted, not ignored.
  • Secrets treated like secrets Credentials our platform holds are stored encrypted. One-time passwords are shown once and never kept. Nothing sensitive gets typed where a log could remember it.

And the everyday layer

Everything promised on the launch page applies here too — the short version:

  • Your code is scanned, first looking for any blatant mistakes AI-built apps make most: passwords sitting in the source, an admin screen anyone can open, a form that trusts whatever it’s handed.
  • Your app runs on a server of its own. Nobody else’s code sits next to yours. (Check the competition, this is important and most don't do it.)
  • Your own web address, with the padlock (SSL is included) — set up, and configured, without you thinking about it.
  • A complete copy of everything, every day, kept somewhere other than the server itself.
  • Something watching it around the clock. If your app stops answering, we hear about it automatically — usually before you would.
  • A private practice copy of your app, so a change can be tried there instead of on the real thing.
  • The keys your app needs — the AI one, the payment one — collected through a secure one-time link, never pasted into an email or a chat.
  • Lastly, as part of your project's setup, we will send you a one-time assessment covering any recommendations we found, including:
    • Code Security
    • Data Handling
    • Performance
    • Scalability
    • And any other relevant areas we identify needing attention, during review...

One more thing, about money: your card details never touch our servers. Payment is handled by Stripe — the same company that processes cards for millions of businesses — and we never see the number.

Get Started

Questions this page didn’t answer? Email hello@lasthost.io — a person reads it.