01 / THE FOUNDATION
Encryption
Beyond HTTPS, our stated approach uses encryption for transmitted and stored data, with industry-standard protocols and a multi-layered solution.
SECURITY / A LITTLE MORE PEACE OF MIND
Built with care.
Protected
in layers.
Our approach to protecting our products, code, models, databases and APIs. Multiple layers, considered access, and safeguards that support fair use.
INFINITODE / PROTECTING WHAT MATTERSIN LAYERS
EncryptionAuthenticationAccess control
MULTIPLE LAYERS / ONE APPROACH
Protecting the work.
Respecting the people.
The principles behind the safeguards described for our products and platform.
02 / THE FOUNDATION
API safety
Our APIs require authentication and use safeguards against misuse. Netlify’s built-in backend protections form part of that approach.
03 / THE FOUNDATION
Access control
Action-level access controls help protect account and user data. Our account records follow a no-password-storage policy.
ACCOUNT SECURITY / YOUR ACCOUNT, YOUR CONTROL
Sign-in you can trust.
Access you can see.
Verification, two-step sign-in, device management and limits on sensitive actions, so that only you can use your account.
01 / ACCOUNT
Verified email
Your API keys are only shown once your email address is verified. Google sign-ins count as verified when Google confirms the address.
02 / ACCOUNT
Two-step sign-in
Sign in with a time-based code from your authenticator app as a second step. Set it up from your account page.
03 / ACCOUNT
Device management
See every device signed in to your account, rename them, and sign any of them out remotely. Inactive sessions expire automatically after 90 days.
04 / ACCOUNT
Recent sign-in
Deleting an account requires a sign-in within the last five minutes. If it has been longer, you will be asked to sign in again first.
05 / ACCOUNT
Key reset limits
API keys can be reset up to three times in any rolling seven-day period. Each reset immediately revokes the old key.
06 / ACCOUNT
Bot protection
Cloudflare Turnstile checks sign-in, sign-up and support forms. In production these checks fail closed, so a missing setting blocks the request.
DATA AND API SECURITY / PROTECTED IN LAYERS
Protected at rest.
Protected on the way in.
How account records, API traffic, payments and submitted forms are handled.
01 / DATA
Encrypted at rest
Sensitive values such as names and API keys are encrypted with AES-256-GCM, a modern authenticated encryption standard, with a unique value for every item. All stored sensitive values use this format.
02 / DATA
Server-side records
Browsers cannot read or write account records directly. Accounts are created and updated by our servers, and each request is checked against the signed-in account.
03 / DATA
Reliable call counting
API calls are counted atomically. Simultaneous requests are each counted once, so a single call cannot be spent twice.
04 / DATA
Short activity retention
API call history is kept for 30 days and then deleted automatically. We keep country and city, never source IP addresses.
05 / DATA
Verified payment events
PayPal payment and subscription events are only trusted after their signature has been verified with PayPal.
06 / DATA
Redacted support forms
API keys, tokens and passwords pasted into support or bug-report forms are redacted before they are stored.
HELIX / EXPERIMENTAL RESEARCH
Another question.
A different line of defence.
We are developing research models focused on cybersecurity, collectively known as Helix. This is experimental research, distinct from the platform safeguards described above.
Something doesn’t look right?
Report suspicious activity so the team can review it.
Good tools.
A thoughtful foundation.
Create an account to explore our tools, resources, experiments and AI models.