Security and operations
for your internal apps
Authentication, access controls, and isolated app runtimes are built in.
Here is how we protect your apps, handle your data, and operate the platform.
App runtimes and managed app databases are hosted in Tokyo, Japan. Account information, logs, and other data may be processed or stored outside Japan, including in the United States.
Direct internet access to app runtimes is blocked
Users visit your app’s URL and authenticate before using it. Container app runtimes are not directly exposed to the internet. They accept requests only through the authentication gateway.
Last reviewed: 2026-08-04
Built-in protections
Start with five things to know about the protections included with Keelson.
Sign-in and access controls
Keelson automatically adds authentication to your apps. Users sign in with a Google or Microsoft account and can use the apps they have permission to access.
No direct internet access
Container app runtimes are not directly exposed to the internet. They accept requests only through the authentication gateway.
Isolation between apps
Each container app has an isolated runtime. Data access permissions issued by Keelson are also limited to the individual app.
Data location
App runtimes and managed app databases are hosted in Tokyo, Japan. Files, backups, logs, and other data may be processed or stored outside Japan.
Access logging
We record whether access to an app was allowed or denied, along with the timestamp and source IP address. We also record the user ID when the user can be identified.
Logs written by your app are not automatically masked. Keep sensitive information out of them.
How we protect access to your apps
We combine transport security, authentication, access controls, and runtime isolation to protect your apps.
Encryption and attack mitigation
Incoming internet traffic is handled at the edge, which provides TLS encryption and helps mitigate the impact of DDoS attacks.
Sign-in and membership checks
Users sign in with a Google or Microsoft account. You choose who can access each app, without implementing a sign-in feature in your code. Integrations with external services use separate authentication, such as tokens.
Network access restrictions
When you configure IP restrictions, only requests from approved networks are allowed. Remote users can connect through an approved company VPN.
Network isolation
Container apps accept requests only through the authentication gateway. They cannot connect directly to another app’s private runtime or to Keelson’s management network. They can connect to external services and to another app’s public URL with the required authentication.
Runtime isolation and limited permissions
Each container app runs in its own environment with VM-level isolation. Apps receive only the permissions they need, and users’ sign-in tokens are not passed to the app.
Encryption and data protection
We encrypt traffic and stored data, and check that a new app version starts successfully before switching traffic to it.
Encryption
- At rest: Databases and files use the encryption provided by our cloud infrastructure providers.
- In transit: Keelson-managed inbound traffic and connections to managed app databases use TLS encryption.
Deployment checks
- For container apps, we check that the new version starts successfully before switching traffic to it.
- If the startup check fails, the current version continues serving traffic. Database changes made during the update are not automatically rolled back.
Where to store your data
- Data in managed app databases and files saved through Files / Media persist across app redeployments.
- The runtime’s local disk is temporary. Store data you need to keep in a managed app database or through Files / Media.
Data use and privacy
We restrict data access to each app and limit the information we record in logs.
Data isolation
- - Data access permissions issued by Keelson are limited to the app’s own data.
- - Those permissions do not allow an app to directly read or write data belonging to other apps or workspaces.
- - You can choose which members have access to each app.
What goes into logs
- - Access logs record details such as the requested resource and the outcome, without including authentication tokens or cookie values.
- - We remove request headers, cookies, and bodies from events sent to error monitoring for the Keelson API and console.
We do not automatically mask sensitive information throughout the logs your app writes. Do not log passwords, tokens, or personal information.
How we use app data
- - Keelson does not use data you upload, store, or process in your apps to train AI models or for its own marketing.
Data retention and privacy requests
- - After your contract ends, we may delete customer data once our designated retention period has elapsed. That period is generally no more than 30 days. Export any data you need before ending your contract.
- - We may retain operational logs for as long as needed for legal compliance, security, or dispute resolution.
- - Requests to access, correct, or delete personal information are handled in accordance with our Privacy Policy.
Backup and recovery
We provide backup and restore features for managed app databases. Files and external databases have different backup requirements, so plan recovery for each storage service you use.
Your app’s database
- - Managed app databases (Managed SQLite) support daily and manual backups, point-in-time recovery (PITR), and backup downloads. The number of backups retained and the available recovery window depend on your plan.
- - You choose the restore point and verify your data and app behavior after restoration.
- - Files / Media files and external databases are not included in these backups. Arrange separate backups as needed.
Keelson’s management data
- - Keelson’s management database is not directly accessible from outside its private network. It has automatic backups and point-in-time recovery, and is hosted in a single region.
- - We do not publish numerical recovery time objectives (RTO: how long recovery should take) or recovery point objectives (RPO: how recent recovered data should be).
Data locations and retention
Storage locations and retention periods vary by data type. Hosting app runtimes and managed app databases in Tokyo does not mean that all data stays within Japan.
| Data type | Storage location | Processing outside Japan | Retention |
|---|---|---|---|
| App databases and files | Databases are in Tokyo. File storage is not limited to a single region. | Content delivery, build output, backups, and file storage may involve services outside Japan. | Retained while the service is provided. After your contract ends, data may be deleted once our designated retention period has elapsed; that period is generally no more than 30 days. |
| Account, workspace, and app management information | Not limited to a single region. | May be processed or stored in the United States, including the western US. Authentication and content delivery may also involve other regions. | Retained for as long as needed for its purpose, then deleted or anonymized when no longer needed. |
| Operational and audit logs | Not limited to a single region. | May be processed or stored in the United States, including the western US. Logging and content delivery may also involve other regions. | Retained for a reasonable period when needed for legal compliance, security, or dispute resolution. |
| App runtime logs | Not limited to a single region. | May be processed or stored by logging services outside Japan. | You can view logs for the period included in your plan. We do not guarantee deletion when that viewing window ends, and we do not publish a deadline for deleting stored logs. |
| Billing information | Not limited to a single region. | Payments may be processed outside Japan, including in the United States. Keelson generally does not retain credit card details. | Retained for as long as needed for payment processing and legal requirements, then deleted or anonymized when no longer needed. |
App databases and files
Storage: Databases are in Tokyo. File storage is not limited to a single region.
Outside Japan: Content delivery, build output, backups, and file storage may involve services outside Japan.
Retention: Retained while the service is provided. After your contract ends, data may be deleted once our designated retention period has elapsed; that period is generally no more than 30 days.
Account, workspace, and app management information
Storage: Not limited to a single region.
Outside Japan: May be processed or stored in the United States, including the western US. Authentication and content delivery may also involve other regions.
Retention: Retained for as long as needed for its purpose, then deleted or anonymized when no longer needed.
Operational and audit logs
Storage: Not limited to a single region.
Outside Japan: May be processed or stored in the United States, including the western US. Logging and content delivery may also involve other regions.
Retention: Retained for a reasonable period when needed for legal compliance, security, or dispute resolution.
App runtime logs
Storage: Not limited to a single region.
Outside Japan: May be processed or stored by logging services outside Japan.
Retention: You can view logs for the period included in your plan. We do not guarantee deletion when that viewing window ends, and we do not publish a deadline for deleting stored logs.
Billing information
Storage: Not limited to a single region.
Outside Japan: Payments may be processed outside Japan, including in the United States. Keelson generally does not retain credit card details.
Retention: Retained for as long as needed for payment processing and legal requirements, then deleted or anonymized when no longer needed.
What Keelson manages and what you manage
Here is what Keelson manages and what you are responsible for.
Keelson manages authentication, runtime environments, and isolation of data access. You manage your app’s authorization logic, business logic, and libraries.
| Area | Keelson manages | You manage |
|---|---|---|
| Authentication and access | Providing sign-in and access controls | Adding and removing members; configuring access permissions |
| Networking | Blocking direct access to runtimes; separating them from the management network | Choosing external services and checking that connections to them are encrypted |
| Runtimes and permissions | Isolating app runtimes; limiting platform-issued permissions | — |
| Encryption and secrets | Encrypting stored data and Keelson-managed traffic | Managing passwords, API keys, and other secrets; encrypting connections to external services |
| Data management | Providing managed app databases, file storage, and database backup and restore features | Choosing what to store and how long to keep it; exporting data; verifying restores |
| Operations and monitoring | Maintaining and monitoring the runtime infrastructure; checking app startup during deployment | Updating dependencies; monitoring app behavior and business process outcomes |
| App code | — | Validating inputs; implementing in-app authorization; handling sensitive information appropriately |
Authentication and access
Keelson: Providing sign-in and access controls
You: Adding and removing members; configuring access permissions
Networking
Keelson: Blocking direct access to runtimes; separating them from the management network
You: Choosing external services and checking that connections to them are encrypted
Runtimes and permissions
Keelson: Isolating app runtimes; limiting platform-issued permissions
Encryption and secrets
Keelson: Encrypting stored data and Keelson-managed traffic
You: Managing passwords, API keys, and other secrets; encrypting connections to external services
Data management
Keelson: Providing managed app databases, file storage, and database backup and restore features
You: Choosing what to store and how long to keep it; exporting data; verifying restores
Operations and monitoring
Keelson: Maintaining and monitoring the runtime infrastructure; checking app startup during deployment
You: Updating dependencies; monitoring app behavior and business process outcomes
App code
You: Validating inputs; implementing in-app authorization; handling sensitive information appropriately
The same responsibilities apply to AI-generated code. Before releasing your app, check that calculations and in-app permission checks work as intended.
Operations and incident response
Keelson monitors and maintains the platform and responds to outages and security issues.
Platform monitoring and automatic recovery
- - For container apps, we check that the new version starts successfully before switching traffic to it.
- - The runtime infrastructure automatically restarts instances that crash.
- - Keelson monitors platform health and detects issues in billing and authentication.
- - You are responsible for monitoring your app’s internal behavior and checking that business processes complete correctly.
Alerts and maintenance
- - When monitoring detects an issue, such as a metric exceeding a configured threshold, it alerts the Keelson operations team.
- - Keelson investigates and responds to issues with the runtime infrastructure and Keelson services.
- - Keelson and its infrastructure providers update the runtime infrastructure and Keelson services.
- - You are responsible for updating your app’s libraries. Those updates take effect when you redeploy.
Outage and security notifications
If we become aware of a security issue that may affect customer data, we notify affected customers within a reasonable period by email, through the console, or by another contact method. We investigate the impact, take interim action, and consider measures to prevent recurrence. We do not guarantee a recovery time.
- - Once we confirm an impact on customer data or service availability, we email an initial notice to the affected workspace’s owners and admins.
- - Until the issue is resolved, we provide updates at least every 24 hours, even when there is no change in status.
- - After resolution, we send a recovery notice and a final report summarizing the impact and cause.
- - If a personal data breach or similar incident triggers a legal reporting duty, we notify the authorities and affected individuals within the deadlines set by applicable law.
Third-party certifications and audits
Our cloud providers’ certifications do not automatically extend to Keelson.
Cloud infrastructure providers
Our cloud infrastructure providers undergo certifications and audits such as SOC 2 and ISO 27001. These cover the providers’ own services and controls.
What this means for Keelson
The certifications and audits described on this page belong to our cloud infrastructure providers. They do not indicate that Keelson itself is certified or has undergone an independent penetration test.
Security reporting contacts
If you find a vulnerability or suspect abuse, please contact the appropriate team below.
Report a vulnerability
Send us the affected feature or URL, the potential impact, and steps to reproduce the issue. See “Vulnerability research and reporting policy” on this page for the scope and conditions of permitted testing. Contact us before testing anything outside that scope.
Report suspected abuse
Report suspected spam, phishing, malicious traffic, illegal content, or other abuse involving an app hosted on Keelson. Include the app URL, time of the incident, and any supporting evidence you have.
How we handle abuse
To protect other users and external services, we prohibit abuse and suspend access when necessary.
Prohibited activities
We prohibit unauthorized access or vulnerability testing, bypassing security controls, attempts to escape an isolated runtime, cryptocurrency mining, spam, excessive load, and using the service to launch attacks.
Suspension and enforcement
We may suspend or terminate apps or accounts without prior notice for prohibited activity or violations of our Terms of Service. Access to apps suspended for abuse is blocked. See our Terms of Service and Acceptable Use Policy for the full rules and enforcement policy.
Vulnerability research and reporting policy
We welcome good-faith research and reports that follow the scope and conditions below.
What you may test
You may test workspaces associated with your own account, apps owned by those workspaces, and your own app URLs on *.keelson.run.
Other workspaces’ apps and data are out of scope, as are automated scans or brute-force attacks against the management API or console (api.keelson.dev and console.keelson.dev), and third-party services used by Keelson. Social engineering of employees and testing of offices or physical equipment are also out of scope.
Prohibited activities and when to stop
Do not perform load tests, DoS attacks, or spam campaigns; access, modify, or delete other people’s data; disrupt service availability; or evade monitoring.
Stop testing immediately if you discover that you may be able to access another workspace’s data. Do not retain any data you obtain; keep only the minimum evidence needed for your report.
How to report and when to expect a reply
Send the affected feature or URL, the potential impact, and steps to reproduce the issue to the address below.
We provide an initial response within three business days of receipt, based on Japan Standard Time. We do not guarantee a deadline for a fix.
Protection for research that follows this policy
Research within this policy’s scope is considered to have our prior authorization under Section 2.1 of the Acceptable Use Policy (AUP). Activities outside that scope remain subject to the prohibitions in that section.
Keelson will not take legal action over research that stays within this policy’s scope, is conducted in good faith, does not affect service availability or other workspaces’ data, is reported promptly after discovery, and is not disclosed publicly until the issue is fixed.
We do not offer monetary rewards or a bug bounty program.
Try your first internal app with built-in authentication
Every plan includes authentication, access controls, and isolation of app runtimes and data access.
No credit card required for Starter / Plus.
Without a card on file, your trial ends after 14 days with no charge.