What happens to your code and data

Your apps, databases and account data run in a data centre in Lauterbourg, France (European Union), on servers rented from Contabo. Builds also run there. Nothing is copied to other regions.

Being in Europe means visitors in Zimbabwe see about 250 ms of network delay per round trip. In our test from Zimbabwe, a first visit (new secure connection) took about 0.8 seconds and later requests about 0.25 seconds. Visitors in Europe see much less.

We load-tested a small web page (5 KB) on the smallest service size (256 MB RAM), through our HTTPS edge, from inside the data centre:

Requests per second

About 1,500, with no errors

Response time

4 ms median, 10 ms for 95% of requests, 16 ms for 99%

Memory used by the app

About 10 MB of its 256 MB

Your numbers depend on your code: database queries, page size and heavy computation slow things down far more than the platform does. Watch memory and traffic on your usage page and move a service to a bigger size when it stays near its limit. These are test results, not a guarantee; we don't offer an uptime agreement (SLA) yet.

In transit

HTTPS for every app address, custom domain, the dashboard and the API. Certificates are issued and renewed automatically.

Passwords

Stored only as bcrypt hashes. We can't see your password.

Secrets

Git access tokens, secret environment variables and database passwords are encrypted in our database with AES-256-GCM.

Disks

Whole-disk encryption isn't in place yet. Don't store card numbers or similar regulated data in your apps.

• Only web traffic (HTTPS) and administrator SSH reach the server. Databases and app containers can't be reached from the internet directly; traffic goes through our edge.
• Every service runs in its own container with a fixed memory limit, so one app can't use another's memory.
• Sign-in and payment endpoints are rate limited to slow down password guessing and abuse.
• Payment details are entered on our payment partner's page. Card and mobile money details never reach our servers.
• Each organisation only sees its own projects, data and invoices; this is checked on every request and covered by automated tests.

Every night we back up the platform database and every customer PostgreSQL database, and keep 14 days of copies. Backups are stored in the same data centre, so for important data also keep your own exports.

• We don't sell your data or use it for advertising. The Promptly website has no tracking or advertising scripts.
• We don't look at the data inside your apps or databases except when you ask us to help, or to stop abuse.
• We use your email address for sign-in, billing and usage alerts.
• Services we rely on: Contabo (servers, France), Netlify (hosts this website), Resend (sends our emails) and our payment partner (takes payments).

Deleting a service or project removes its containers and its database storage straight away. Copies in the nightly backups disappear within 14 days.

The Free plan pauses apps that pass 5 GB of traffic in a month. We remove apps used for phishing, malware or spam.