Security and isolation
Where your data lives, how services are isolated and how secrets are kept.
Data residency
Raseef runs in one region, Riyadh. Your services, their volumes, their backups and their logs stay in Saudi Arabia.
Isolation
- Networks. Each environment has its own private network. Services in other environments, other projects and other accounts cannot connect to yours. Only public HTTP services are reachable from the internet, and only through the gateway.
- Containers. Each replica runs in its own user namespace: a process that is
rootinside the container is an unprivileged user on the machine. Containers cannot be privileged, cannot gain privileges, have no raw network sockets, run with the default system call filter and do not share the machine's network or processes. - Templates run as a fixed non-root user, with a read-only root filesystem and every Linux capability dropped.
Secrets
- Variables are encrypted at rest with AES-256-GCM, bound to their service, with keys that can be rotated without downtime.
- Showing values is limited to people who can edit the service, and each time is recorded in the audit log.
- Values are masked in build and runtime logs.
Source code
The GitHub App reads repositories only. Each fetch uses a token limited to one repository, read access to its contents, revoked right after the fetch.
Traffic
- HTTPS with TLS 1.2 or newer on every public address, including custom domains.
- Per-visitor limits and automatic blocking at the gateway. See Public HTTP.
- Outbound email on port 25 is blocked.
Advisories
| Date | Advisory | What Raseef did |
|---|---|---|
| 2026-10-26 | Node.js Brotli decoder (CVE-2026-111497), fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 | The gateway refuses request bodies compressed with Brotli for every app. Rebuild your Node.js images on a fixed version: the gateway cannot protect responses your app fetches from other servers. |
Report a problem
Report abuse of the platform at raseef.dev/abuse.