Caffeine apps are secure by design — not through add-on security tools. Security is built into the architecture of the Internet Computer, not bolted on afterward.
How apps are protected from cyber attacks
Caffeine apps run on a mathematically secure, tamperproof, serverless network. There is no underlying operating system, database, or application server to exploit.
Because the execution environment is fundamentally different from conventional cloud infrastructure:
- There is no OS to compromise with malware or ransomware
- There is no application server to misconfigure or exploit
- Only verified app logic can execute, against verified data only
- Privilege escalation attacks have no foothold
No firewall configuration, anti-malware, or DDoS protection is needed. These threats simply don't apply to the execution model.
Where your data is stored
Your app's data is stored on the Internet Computer network, inside the app's canister. It lives and runs entirely on the decentralized ICP network — there is no third-party cloud database (AWS RDS, Google Cloud SQL, etc.) where your data sits separately.
Because data is inseparable from the app logic, it shares the same tamperproof guarantees as the app itself.
File uploads (images, documents, etc.) are stored on Caffeine's managed storage infrastructure — a service operated by Caffeine Labs, separate from the ICP network itself.
Caffeine's data practices
Caffeine collects data necessary to operate the platform — your account information, usage data, and app analytics (if you are on a plan that includes it). Caffeine does not sell your data or your users' data.
For full details, see the Privacy Policy and Terms of Use.
Frequently asked questions
Do I need to configure security for my app?
No. Security at the infrastructure level is handled by the Internet Computer. Your responsibility as an app builder is to design appropriate access control within your app — for example, ensuring admin-only features are properly restricted. The AI generates sensible defaults for this, and you can ask it to add stricter controls if needed.
Is my app's code visible to others?
Your source code is private by default. It is stored in your project and accessible only to you. If you export to GitHub, you control what is shared.
What data does Caffeine store about my app's users?
Caffeine does not have access to your app's user data. User data is stored inside your app's canister on the Internet Computer — only your app's code can read it. Caffeine operates the deployment infrastructure but cannot inspect your app's data.
Can Caffeine access my app's data?
Caffeine operates the platform and deployment infrastructure, but the data inside your app's canister is controlled by your app's code. Caffeine does not have the ability to read or modify your users' data through the normal operation of the platform.
Am I the controller of my app's canisters?
No. When you deploy an app through Caffeine, Caffeine is the controller of the canisters it creates on your behalf. This is what allows Caffeine to manage deployments, cycle top-ups, and infrastructure for you automatically. You do not need to interact with the Internet Computer directly — canister management is part of what Caffeine provides as a service. If you are familiar with the Internet Computer and want direct canister control, note that third-party tools like CycleOps cannot top up Caffeine-managed canisters because they require controller access.
What happens to my data if I cancel my subscription?
Your live app remains deployed and your data remains in the canister. If you delete your project, all associated data is permanently deleted. Cancelling a subscription reverts your account to the free plan — it does not automatically delete your apps or data.
Is Caffeine GDPR compliant?
Caffeine Labs AG is a Swiss company and operates under Swiss and EU data protection principles. For specific compliance questions, refer to the Privacy Policy or contact support.