Caffeine apps are secure by design — not through add-on security tools. Security is built into the architecture of the Internet Computer, not bolted on afterward.
How apps are protected from cyber attacks
Caffeine apps run on a mathematically secure, tamperproof, serverless network. There is no underlying operating system, database, or application server to exploit.
Because the execution environment is fundamentally different from conventional cloud infrastructure:
- There is no OS to compromise with malware or ransomware
- There is no application server to misconfigure or exploit
- Only verified app logic can execute, against verified data only
- Privilege escalation attacks have no foothold
No firewall configuration, anti-malware, or DDoS protection is needed. These threats simply don't apply to the execution model.
Password-protecting draft and live URLs
Infrastructure security is handled for you. Separately, you can put a site password in front of your app's draft URL, live URL, or both — so people who only have the bare link cannot open the app until they enter the password. Configure it from project settings → More → Password protect. See Password Protecting Your App.
Where your data is stored
Your app's data is stored on the Internet Computer network, inside the app's canister. It lives and runs entirely on the decentralized ICP network — there is no third-party cloud database (AWS RDS, Google Cloud SQL, etc.) where your data sits separately.
Because data is inseparable from the app logic, it shares the same tamperproof guarantees as the app itself.
File uploads (images, documents, etc.) are stored on Caffeine's managed storage infrastructure — a service operated by Caffeine Labs, separate from the ICP network itself.
Caffeine's data practices
Caffeine collects data necessary to operate the platform — your account information, usage data, and app analytics (if you are on a plan that includes it). Caffeine does not sell your data or your users' data.
For full details, see the Privacy Policy and Terms of Use.
Frequently asked questions
Do I need to configure security for my app?
Infrastructure security is handled by the Internet Computer — you do not configure firewalls or similar tools. Your responsibility as an app builder is access control: who can open the URL, who can log in, and what each role can do. Optionally lock draft and/or live URLs with a site password from project settings → More → Password protect. Inside the app, the AI generates sensible role defaults, and you can ask it for stricter controls if needed.
Is my app's code visible to others?
Your source code is private by default. It is stored in your project and accessible only to you. If you export to GitHub, you control what is shared.
What data does Caffeine store about my app's users?
Caffeine does not have access to your app's user data. User data is stored inside your app's canister on the Internet Computer — only your app's code can read it. Caffeine operates the deployment infrastructure but cannot inspect your app's data.
Can Caffeine access my app's data?
Caffeine operates the platform and deployment infrastructure, but the data inside your app's canister is controlled by your app's code. Caffeine does not have the ability to read or modify your users' data through the normal operation of the platform.
Am I the controller of my app's canisters?
No. When you deploy an app through Caffeine, Caffeine is the controller of the canisters it creates on your behalf. This is what allows Caffeine to manage deployments, cycle top-ups, and infrastructure for you automatically. You do not need to interact with the Internet Computer directly — canister management is part of what Caffeine provides as a service. If you are familiar with the Internet Computer and want direct canister control, note that third-party tools like CycleOps cannot top up Caffeine-managed canisters because they require controller access.
What happens to my data if I cancel my subscription?
Your live app remains deployed and your data remains in the canister. If you delete your project, all associated data is permanently deleted. Cancelling a subscription reverts your account to the free plan — it does not automatically delete your apps or data.
Is Caffeine GDPR compliant?
Caffeine Labs AG is a Swiss company and operates under Swiss and EU data protection principles. For specific compliance questions, refer to the Privacy Policy or contact support.