Security
Isolated and secure by default
Every project runs on its own Postgres database with its own credentials. Access rules live in SQL and apply to every request, file and realtime message.
Isolation
One project, one database
Projects never share a database. Each has its own Postgres database, roles, JWT secret, API keys and database password. Delete a project and everything goes with it.
Protection
Security on every layer
Row Level Security everywhere
Write access rules once in SQL and they apply to the REST API, Storage and Realtime. Users only see the rows your policies allow.
TLS required
All APIs are served over HTTPS and Postgres connections require TLS, from the dashboard to psql and your ORM.
Separate keys for browsers and servers
A public anon key for browsers and a secret service_role key for servers. service_role bypasses RLS and belongs on servers you control.
Per-project credentials
Every project has its own roles, JWT secret, API keys and database password, so one project can never read another.
Limits on every plan
Request rates, query timeouts, connection counts and upload sizes are enforced per project, so one busy app cannot slow down the rest.
Users in your own database
Authentication users live in your project's database, and auth.uid() lets your policies check who is signed in.
Checklist
Ship securely
Enable RLS on every table
Turn on Row Level Security for each table in
publicand add policies for the rows each user may read and write. Row Level Security guideKeep secrets on the server
Only the anon key belongs in browser code. Never ship the service_role key or the database password to clients. API keys
Connect over TLS
Use the connection strings from the dashboard; they require TLS on ports 5432 and 6543. Connect to Postgres
Start building on StitchDB today
Create your first project in under a minute.