Security and isolation

Each app runs in its own containers on its own private network. An app can reach its own database and, with limits, the internet, but it has no direct route to other apps or to the systems that run Percher. App containers run with minimal privileges. If your app uses Percher's database, it gets its own instance with its own storage.

You sign in to Percher with an email address and a password. Your Percher account password is stored only as a salted hash, never in clear text. New accounts confirm their email address, sign-up and password reset include a bot check, and sign-in attempts are rate limited. Resetting your password signs out all your existing browser sessions.

With MFA, you sign in with your password and a code from an authenticator app. It is optional for ordinary accounts and required for administrator and moderator access.

1. Open Account > Security and choose Enable MFA.
2. Enter your Percher password and choose Set up authenticator.
3. Scan the QR code with an authenticator app that generates time-based codes (TOTP). If scanning fails, choose Enter setup key manually and enter that key in the app.
4. Enter the app's six-digit code in Authenticator code and choose Verify.
5. Save the recovery codes somewhere you can access if you lose your authenticator. Select I saved my recovery codes, then Done. The card shows Enabled; Manage MFA opens its controls.

After entering your password at sign-in, enter a current authenticator code. You can choose Use a recovery code instead; each recovery code works once. Never share your password, setup key, QR image or recovery codes in chat or support messages.

Open Manage MFA. Enter a current authenticator code, or choose Use a recovery code and enter an unused recovery code. Choose Verify. Within five minutes, enter your password and choose Generate new recovery codes. Save the new codes, select I saved my recovery codes, then choose Done. The previous set stops working.

To change devices, verify a code as above and enter your password, then open Replace or disable authenticator and choose Disable authenticator. Enter your password again and choose Set up authenticator for the new device. Save its recovery codes and verify the setup. Staff access stays blocked until the new authenticator is verified.

If you lose your device, sign in with an unused recovery code and replace the authenticator. If you also lose the codes, get help without signing in. Password reset does not reset MFA, and email access is not a substitute for a second factor.

In Account > Security, choose Change password, enter your current password and confirm the new one. A successful change signs out your other browser sessions and leaves your MFA setting unchanged. Cancel discards the draft.

Under Browser sessions, Sign out other browsers keeps this browser signed in. CLI and AI assistant connections are separate; manage them in Account > Connections.

Traffic to Percher and to your apps uses HTTPS. Environment variables, KV store values and webhook signing secrets are encrypted at rest with AES-256. Percher API tokens and deploy hook links are stored only as hashes, so they cannot be read back. Nightly backups are encrypted with AES-256 and kept off-site for up to 30 days.

Percher staff can technically reach data hosted on the platform, because we run the servers and hold the keys that decrypt stored secrets. That access is limited by our own rules, not blocked by encryption. We do not open your code, logs, database or secrets to answer a support request; if we need to see something, we ask you to send it. If an app puts other customers or the platform at risk, we may stop it. Stopping an app leaves its code and data as they are.

Your apps, their data and their backups are hosted in the EEA, in Germany and Finland. Some providers we use, for example for email and payments, process limited data outside the EEA. The privacy policy and the subprocessor list name each one.

Email security@percher.app. The security policy explains what to include, what is in scope and what to expect.