See how mypage isolates projects, keeps credentials out of source, tests the browser flow, and binds approval to the exact artifact you publish.
Review status and evidence stay bound to the exact artifact fingerprint.
Every claim here is limited to a control we can explain and test today. We do not display SOC 2, ISO, data-residency, or blanket “never used for training” badges without a current contractual and operational record. Validate the provider and region configured for your deployment before placing regulated data in a project.
Owner, admin, editor, and viewer permissions are enforced by server-side project and workspace checks. Generated database starters declare their own role and row-policy boundary; a template never makes an anonymous admin promise.
Provider credentials are submitted over an authenticated path, encrypted by the platform boundary, and cannot be read back from the workspace. They are omitted from generated source, logs, browser storage, and exports.
A source scan produces a fingerprint. Publishing is fail-closed when critical or high findings remain, and activation is tied to the exact requested revision and its final artifact scan—not a different passing build.
Checkpoints protect source and supported project data, and restore creates a safety point first. Deletion enters a tombstoned pending state before scoped cleanup; ordinary application paths cannot bypass that lifecycle.
Each check reports its stage, status, evidence, and next action. The server—not a hidden client toggle—enforces the publish decision.
Scans source and the final build artifact for credential-shaped values.
Reviews row policies and project-scoped data boundaries.
Flags callable database capabilities that cross a user boundary.
Flags unresolved authentication markers on privileged routes.
Finds sensitive data placed in durable browser storage.
Reviews redirect, iframe, and browser execution sinks.
Flags unresolved connector markers that are not launch-ready.
Uses a platform-managed package and lockfile boundary; registry vulnerability review remains a release/CI responsibility.
Re-scans the exact production bundle before it can be activated.
Workspace authorization, sandbox preparation, encrypted project-secret handling, release checks, revision activation, backups, and lifecycle cleanup.
The data entered into the generated app, final user roles and row policies, connector recipients, legal notices, retention requirements, and every finding you accept before release.
A configured project may use Amazon Web Services, Supabase, Anthropic or Z.AI, plus only the payment, messaging, map, shipping, or business-data connector you select. The project launch checklist identifies those boundaries; provider setup is never implied by a template screenshot.
A dated production subprocessor register, independent assurance report, public status history, formal incident SLA, and residency matrix are GA release gates—not claims made by this preview page.
Include the affected route, expected boundary, observed result, and a safe proof of concept. Do not send credentials, personal data, or destructive payloads.