Security at 100 Fields Studio
What we actually do today to protect your apps and data. We do not claim certifications we do not have.
Isolated apps
Every app runs in a sandboxed page with its own empty origin, so it cannot read the studio’s cookies or other apps’ data. Server functions run in a separate WebAssembly sandbox with limits on memory and run time and no access to internal addresses.
Access rules
Who may read and change each collection is enforced on the server (public, signed-in, owner, admin). Team roles (owner, editor, viewer) are checked on every request.
Passwords & keys
Passwords are stored only as salted scrypt hashes. Secret keys of your apps are stored encrypted and never shown again. API keys are stored only as SHA-256 hashes. Login sessions are signed.
Data location
Database and uploaded files are stored in the Frankfurt (EU) region of our providers Neon and Vercel. Payments are processed by Stripe; we never see card details.
Checks for your app
The built-in security & quality check finds secret keys in code, personal data readable by everyone, risky code patterns and more – with a free AI fix.
What we do not have (yet)
No SOC 2 or ISO 27001 certification, no external penetration test and no bug bounty programme so far. Please report vulnerabilities to info@100fields.com – we answer within 2 working days.