Your software.
Your data. Your choice.
Boat House helps you put small apps online and share them with the people you choose.
Boat House does not currently hold a SOC 2 report or ISO 27001 certification. We do not offer a HIPAA service or sign Business Associate Agreements. Do not use the hosted service for protected health information, regulated student records, children's personal data, or payment card numbers.
What is in place
- Encrypted web connections. HTTPS protects connections from your browser or agent to Boat House.
- Access you control. Choose viewer, editor or admin access. Account passwords are hashed. Invitations and account recovery require proof of access to the email address.
- Separate app resources. Apps have separate containers, file volumes and database credentials, with limits on memory, CPU and processes. They run on shared infrastructure.
- Protected app secrets. Secrets entered through Boat House's secret settings are encrypted in the control database. This does not mean all app data or backups are encrypted at rest, or that the service is end-to-end encrypted.
- Backups and export. We create nightly database and file backups. You can export your app's source, database and files. Hosting is in the United States.
Sharing is a security decision
An admin can change an app's code, read its secrets, manage sharing and delete it. Give admin access only to people you trust with the whole app. An agent acts with the permissions of the person who connected it.
The app matters too
Boat House controls entry to your app. The app's code must also handle permissions, data validation and external services correctly. Software built by an AI agent still needs review. If your agent receives data or code, its provider's terms and settings apply too.
Open source and independently audited are different
Boat House's source code is available under Apache 2.0. You can inspect it and host it yourself. That license is permission to use the software; it is not a security certification. Our infrastructure providers' certifications do not certify Boat House.
Ask us about your requirements
For security questions, a suspected vulnerability or a data processing agreement request, contact allen@boathousecloud.com. Please describe the issue without sending passwords, connection codes or customer records.