Where your site lives, and what happens when something fails.

Your published site

Your pages are published as static files to a content delivery network with servers around the world. They are served from there, not from our application — so if our API is down, your site stays up, and a visitor never waits on us to read your page.

Where the platform runs

The application and its database run on Railway in the United States; your files and published pages are stored on Cloudflare. The database is backed up automatically by its host. The full list of every company that touches customer data, with what each one sees, is the Subprocessors page.

Payments

Card payments run through your own Stripe or PayPal account, connected on your site’s Payments screen. The card number is entered on their pages and never touches our servers; we hold your keys encrypted and show you only the last four characters. Bank transfer and cash on delivery are recorded, not processed. Money goes to your account, never through ours.

Your account

Passwords are stored hashed, never in a form we can read. Every site, order, customer and mailbox is scoped to the account that owns it; a request for another account’s data is refused, not merely hidden. A connector key you mint on your account page lets a tool build sites as you without your password, and is shown once.

Your customers’ data

Orders, customer records, form submissions and mail are yours. We do not sell them, use them to market to your customers, or share them between accounts. Every marketing email your shop sends carries an unsubscribe link and honours it.

Failure, said out loud

When something cannot be done, the screen says so in words — a refused send, a payment that did not confirm, an import that could not copy a file. We would rather you see the refusal than a green tick that was not true.

Leaving

Export what you need at any time, no fee. When you ask us to delete your account we do it and tell you the date it was done.