Security

How projects are isolated and protected: TLS everywhere, a database per project, Row Level Security, keys and network protection.

#Isolation

Every project has its own Postgres database with its own roles, password, JWT secret and API keys. Only your project's roles can connect to your database; other projects on the same server can't see or reach it. Extensions that could cross that boundary are blocked, and HTTP requests from SQL can't reach private or internal addresses (HTTP from SQL). Delete a project and everything goes with it.

#Encryption in transit

All APIs are served over HTTPS. Postgres connections must use TLS 1.2 or 1.3; unencrypted connections are refused. Postgres itself is never exposed directly: connections go through the StitchDB connection pooler, which only lets your project's owner role in, with SCRAM password authentication.

#Keys

#Row Level Security

RLS applies to the REST API, Realtime and Storage. Tables created with SQL start with RLS off, so enable it on every table in public; Studio and Advisors warn you about tables without it. See Row Level Security.

#Network protection

Every StitchDB server protects itself at its edge against floods and abuse:

• A firewall limits how many new connections each source address may open per second and at the same time, for HTTPS and for Postgres, and drops malformed packets, fragments and reflection floods before the server spends any work on them.
• Web and DNS traffic is handled without per-connection tracking, so floods from forged addresses can't exhaust the server's connection table.
• Per-address and per-network request and connection limits on the web server, so a flood that keeps switching addresses inside one network shares a single budget, plus timeouts against slow-request attacks.
• Requests without a valid project API key are rejected at the edge, before they reach any service, and connections for unknown names are refused before the encryption handshake.
• An intrusion-prevention system that blocks addresses scanning for vulnerabilities, brute-forcing passwords (including database logins), using known flood tools or repeatedly exceeding limits, together with a shared blocklist of known attackers.
• Per-project limits from your plan: API requests per second, connections and auth rate limits.

#Acceptable use and abuse protection

StitchDB protects its servers and its IP reputation so one project cannot spoil the service for everyone:

• Edge Functions cannot send e-mail directly (no outbound SMTP) or connect to crypto-mining pools; a function using sustained CPU like a miner is disabled automatically, and the owner is e-mailed.
• Files served from public buckets that are web pages, SVG, XML or scripts are always downloaded, never rendered on a project domain, so stored files cannot host a phishing page; executable files cannot be stored on the Free plan.
• Auth e-mails have an hourly and a daily limit per project; a project with many bounces or spam complaints is limited automatically until it is reviewed.
• There are limits on how many projects one account or one network can create, to stop automated sign-up abuse.
• Found something being hosted or sent through StitchDB that breaks these rules? Report it at stitchdb.com/abuse or e-mail [email protected].

#Secrets at rest

OAuth client secrets and SMTP passwords are stored encrypted. Vault encrypts your own secrets with a per-project key. Access tokens for AI tools are stored only as hashes.

#Your StitchDB account

#Two-factor authentication

Turn it on in Account › Two-factor authentication: scan the QR code with an authenticator app (1Password, Google Authenticator, Authy and others) and enter the 6-digit code. From then on, signing in to the dashboard needs your password and a code. Sessions that were signed in without a code stop working for the dashboard and the platform API until you enter one. Access tokens for AI tools and the CLI keep working, but creating a new one needs a session with the code.

Create backup codes right after turning it on and store them in a password manager. Each code works once: using one on the sign-in screen (Use a backup code) turns two-factor authentication off so you can set it up on a new phone. We e-mail you whenever two-factor authentication is turned on or off.

#Require two-factor authentication for a team

An organization owner who uses two-factor authentication can require it for every member in Organization › Security. Members without it can still use their own organization, but they can't open this organization's projects, through the dashboard or with their access tokens, until they turn it on. Organization and project tokens are not people and are not affected.

#Sessions

Account › Sessions lists every browser and device signed in to your account, with its IP address and when it was last active. Signing a session out, or all other sessions, takes effect at once.

#Sign-up and sign-in protection

StitchDB accounts are created with an e-mail address that must be confirmed. Throwaway e-mail services are refused, sign-ups are limited per network, and the sign-up and password-reset forms run a short verification check in your browser (a fraction of a second of computation; there is nothing to click). After several wrong passwords for an address, signing in to it needs the same check. Sign-up, password reset and magic links answer the same way whether or not an account exists for the address, so they can't be used to find out who has an account.

#Your data and deleting your account

Account › Your data › Download my data gives you a JSON file with everything StitchDB stores about you: your account, sign-in methods, organization and memberships, list of projects, access tokens (names and dates, never the tokens), billing records and activity. The data inside your projects is exported from each project's Backups page (Export current data), or with pg_dump.

Delete my account asks for your password (or a recent sign-in for GitHub and Google accounts) and deletes the account 7 days later; you can cancel until then, and we e-mail you when it is scheduled and when it is done. Delete or transfer your projects and remove your organization's members first. Your subscription stops renewing as soon as you ask. Invoices and payment records are kept only as long as tax law requires, without your e-mail address.