Public marketing
Public content, docs, legal, pricing, and account-entry routes.
Security
A clear security boundary before bigger claims.
Deploir keeps customer and operator surfaces separate, holds provider credentials on server-side paths, and describes the current boundary without claiming certifications that are not verified.
Current security overview
These are the public security characteristics represented in the product and route model today.
- Organisation-scoped workspace access
- Separate customer and staff applications
- Server-side provider credential handling
- Role-aware operator membership checks
- Webhook signature and delivery validation
- Audit-log foundation for operational actions
- Customer and internal incident visibility boundaries
- Fail-closed protected routes when authentication is unavailable
Access topology
Marketing remains public. Base is the protected customer workspace. Ops is the protected internal operational workspace. This separation matters because customer release activity and operator intervention are not the same thing.
Base
Customer workspace for projects, deployments, domains, support, and settings.
Ops
Internal operational workspace for organisations, deployments, incidents, support, and audit review.
Protected-route behaviour and audit boundary
Protected routes fail closed when authentication or membership checks are not satisfied. Operational actions are designed to retain an audit trail rather than being hidden as provider-only activity.
Compliance boundary
Deploir does not currently claim SOC 2, ISO 27001, PCI DSS, HIPAA, or guaranteed uptime. Workloads with stricter isolation, regulatory, or contractual requirements require a separate technical and commercial review.