A real backend, governed on every request.

Every app here sits on a real backend — real tables, real permissions, real deployments. The AI reaches it only through an authenticated control surface of named operations, with your permissions, and every change it makes is staged, visible, and reversible. This page is the summary; each section links to the receipts.

Six claims, and the mechanism behind each

Each one names the mechanism that backs it and the page that documents it. The underlying architecture references ship with the security overview on request until our documentation site is live, so a reviewer can trace a claim rather than take it on trust.

1. Authenticated on every request. A bearer token is validated against the platform on every call; a rejected request receives a bare 401 with no tool list, schema, or server details.

   Receipt MCP server auth model Read more →

2. The AI acts with your permissions, never its own. The MCP server forwards your token on every platform call and the platform performs authorization; the server never decides who can do what.

   Receipt Token forwarding, one identity across surfaces Read more →

3. Named, guarded operations — no code path into your backend. For platform apps the agent never sees raw solution JSON and cannot emit code — every change is one of approximately 100 named operations the platform validates. Custom frontends are the stated exception: there the agent writes React source, versioned and promoted through the same role gates and deployment log, and it cannot run server-side code.

   Receipt Maps-not-JSON contract Read more →

4. Staged, previewable, reversible edits. begin-solution-edit stages changes, preview-solution-edit shows an entity-level diff, commit-solution-edit lands them once, rollback-solution-edit discards them; an idle transaction rolls itself back after sixty seconds.

   Receipt Transactional edit model Read more →

5. Row-level tenant isolation, explicit tenant context. Every object table carries a tenant column with an auto-injected filter, and every data write fails fast unless the session has named its tenant.

   Receipt Multi-tenancy model Read more →

6. Role-gated promotion, non-destructive rollback, append-only log. Custom frontends promote develop → staging → production under owner / editor / viewer roles; production is owner-only; rollback adds a deployment row rather than deleting one.

   Receipt Promotion chain and deployment log Read more →

IT checklist

The questions an approver asks first, answered in one line each, with the page that carries the detail.

One page per question

Six pages, one question each. Send the relevant one to the person who owns that question.

What we do not claim

A security page is only useful if it says where the edges are. These are ours.

• Not self-hostable. The backend runs on managed cloud infrastructure we operate, built primarily on AWS. There is no on-premises or customer-cloud option.
• No dedicated infrastructure per customer. Isolation is at the data layer within your account and at the CDN tenant layer for hosting, not separate stacks.
• No custom domains yet. Every app gets an HTTPS URL on our domain per environment. Bring-your-own-domain is not available today.
• Uncommitted staged edits are not durable. A transaction that has not been committed lives in memory and is lost on restart or after sixty idle seconds. Commit is what persists.
• No SOC 2 badge until it is earned. Attestation status is published plainly on the compliance page, including what is still being decided.
• No claim that the AI cannot make a bad edit. The claim is narrower and testable: it cannot inject code, you see the diff before it lands, and you can reverse it after.
• Platform apps do not leave the platform. Your object data exports through a documented API and custom frontends are ordinary repositories, but a platform-built app stops running when the license ends. The whole trade is on ownership and lock-in.

Report a vulnerability

Write to security@codemonster.ai. The disclosure policy covers scope, what to include, and what to expect; the same contact is published at /.well-known/security.txt.

Questions approvers ask

The checklist above answers auth, tenancy, and bad edits. These two it does not.

Governance is part of the organization license, not a tier. No tokens. No credits. No meter. You bring the AI subscription you already pay for. What it costs is quoted, not listed — how pricing works.

Bring the questionnaire and we answer it live, with your builder in the room.