What it does today
This page is deliberately split. Everything above the line is running and exercised by tests on every change. Everything below it is planned, and saying so is cheaper for both of us than finding out after you have moved twenty sites across.
Running now
Per-site isolation
Each environment is its own Kubernetes namespace with a resource quota, a restricted pod security policy, and a network policy that denies traffic in both directions except what the site needs. Each site gets its own MySQL database and its own user, granted on that database and nothing else.
Tenant isolation in the control plane
Every table carrying customer data has row-level security, forced even for the table's owner. A 35-assertion suite proves one organisation cannot read another's rows, and it runs before any deployment is allowed to finish.
Placement policy
Cheapest, fastest, balanced, or pinned to a substrate you name. Restrict the providers and regions you will accept, and set audience regions so latency is weighted by where your readers actually are.
Compensating provisioning
Site creation is a saga: if any step fails, the completed steps are undone in reverse order and the operation records both. No orphaned namespaces, no databases nobody owns.
Operation timeline
Every long-running action returns a handle, and the console shows each step, its outcome and its duration. When something fails you are told which step, and whether what it created was removed.
Append-only audit log
Who did what, when, and to which resource — in a table the application cannot update or delete, enforced by the database rather than by convention.
Scoped API keys
Keys carry a ceiling: the permissions they can ever exercise are the intersection of the holder's roles and the scopes the key was issued for, so a key cannot outgrow its purpose even if its creator is an owner.
Organisations and roles
Invite colleagues, bind roles, switch between organisations you belong to. The organisation comes from your session, never from the request.
Planned, and not yet built
Named here because a feature list that quietly includes the roadmap is how people end up migrating onto something that cannot do the job.
Backups and restore
Policies, incremental chains, and restore verification. Not built. Keep your own backups today.
Staging and clone
Clone to staging, diff, promote. Designed, not implemented.
Managed updates
Update detection, canary rollout, automatic rollback on failure.
Metrics and health
Per-site request and error rates from an in-site agent. The health column reads "unknown" until then.
Webhooks
Events are recorded transactionally already; nothing delivers them yet.
Billing
Plans exist and are recorded. No invoicing, and nothing is charged.
Where this is up to. The platform runs, and the parts above the line are tested on every change. It is early: if you are moving a business-critical site, talk to us first and keep your own backups until the backup service ships.