The short version
- Every site has its own database, and its images and files are kept in a folder of their own. How sites are kept apart is set out below.
- Every page is served over HTTPS, with certificates that renew themselves.
- There are no plugins to update, because there are no plugins. The things plugins used to do are built into the platform and kept current by us.
- We hold no security certifications. What we do not claim is set out below, in the same size type as what we do.
What we do
How sites are kept apart
Every site we set up gets a database of its own. The pages we serve for your site are read from that database, and the images and files we copy across are kept in a folder named for your site. The sites we host share our software and our machines, so what keeps them apart is that software, not a separate server for each customer. If you choose Path A instead, your database and file storage are created in your own Cloudflare account.
TLS everywhere
Visitors reach your site over HTTPS. The certificate is issued and renewed automatically, so there is no annual renewal to forget and no expiry warning in a browser. Our own admin and preview pages are HTTPS only, and traffic between our components stays inside Cloudflare’s network.
Nothing to patch at eleven at night
The classic WordPress break-in is an out-of-date plugin. Migrated sites do not run WordPress, PHP or any plugin code: the features live in our platform, and we update them centrally for everyone at once. There is no wp-login.php to brute-force, no plugin marketplace code running inside your site, and no update you are expected to notice.
Access and keys
- Your site’s admin requires a signed-in session. Your preview does not: its link is based on your domain name, so it is not a secret, and anyone who has it can open the preview. Search engines are told not to list it. Do not put confidential content in a preview.
- If your site goes into your own Cloudflare account, the API token you paste is checked, then sealed with our operator’s public key before anything is stored. Our servers keep only that sealed copy, which they cannot open; the person who moves your site can. We delete it from our database when they open it, when your site is live, or after 48 hours, whichever comes first. The database keeps its own recovery history for 30 days, so the sealed copy can stay in that history for up to 30 days after we delete it; only our operator’s key opens it. Any copy of the database we keep outside Cloudflare leaves it out. The token in plain text is never written to our database. That is not a promise on a web page: an automated test walks every stored row looking for the token and fails the build if it finds it. The token itself stays in your Cloudflare account until you delete it there.
- Card details go straight to Stripe. We never see or store a full card number.
- Any password you give us for a migration — an old hosting login, say — is used for the migration and then we ask you to change it. Change it anyway, on principle.
Backups
For each site we host, and for the images and files we copy across during a migration, the media files are copied to a separate backup bucket in the same Cloudflare account. A file that is replaced or deleted stays there for 30 days by default, and putting it back is a manual step we do. That copy is not off-site, and there is no other scheduled backup job, verified backup retention or one-click restore. The host CLI has operator-run local backup tools; these are not an automated off-site backup service. Keep an independent backup and agree on backup and restore arrangements before relying on hosting.
People
A short, named list of people has access to production, and they are the same people you already email. Access is removed when someone stops working on Embark. We use individual accounts with two-factor authentication on every service that holds your data, and we do not share logins.
If something happens
If we confirm a breach affecting your site or your data, we will email you as soon as we can, and within 72 hours of confirming it. We will tell you what we know, what we do not know yet, and what we are doing about it. We would rather send an uncomfortable email early than a polished one late.
What we do not claim
Security pages tend to imply more than they say. Here is what we do not have, so that you can decide with the real picture:
- No SOC 2, ISO 27001 or PCI certification. No auditor has reviewed us. If your organisation requires a certified vendor, we are not one yet.
- No dedicated server per site. Your site shares our software and machines with other customers’ sites. The separation described above is done in that software.
- No independent penetration test. When we have had one, this page will say so and say when.
- Not suitable for regulated health data. We are not set up for HIPAA and we will not sign a business associate agreement. Do not put patient records on Embark. The same goes for any other regime we have not named here.
- No 24/7 on-call rota. We are a small team in one timezone. Outside working hours, the honest answer is usually “in the morning”.
- No uptime guarantee with service credits in the current terms.
- We depend on other companies. Cloudflare, Stripe, Resend and the provider behind the migration assistant all hold or move some of your data. Their security is theirs to run; a serious failure there is a serious failure here.
- We cannot protect what you publish. Anything on a public page is public, and no platform can stop a visitor from copying it.
- Your content is not encrypted with a key only you hold. We can read your site’s data, because we have to be able to serve it. Anyone who tells you otherwise about a hosted website is describing a different product.
Telling us about a problem
If you find a hole, email hello@embarkeasy.com with enough detail to reproduce it. We do not run a paid bug bounty — we do not have the money — but we will acknowledge you within five business days, tell you what we are doing, credit you publicly if you would like that, and fix it.
We will not pursue legal action over research that stays within your own site and account, does not touch other customers’ data, does not degrade the service for anyone else, and gives us a fair chance to fix the problem before it is published.
Related pages
What we collect and how long we keep it is on the privacy page. What we owe each other contractually is in the terms.
Contact
Minuscule Ventures, LLC — hello@embarkeasy.com. Weekdays, usually the same day.