Security

Cliux runs on a single virtual server at Hostinger, behind a reverse proxy that terminates TLS for the platform and for every published site's domain. There is no second region and no standby server; if the machine is down, the service is down, which is why the service commitments page promises no uptime figure.

The database is dumped every night and the last fourteen dumps are kept on the server. Each verified dump is also encrypted with a key whose private half never touches the server and copied to Backblaze B2 under a key that can write but not delete, so a compromised host cannot take the backups with it. Once a month a script restores the newest off-site copy into a scratch database and compares it with the live one, so the backups are known to restore rather than assumed to.

Console sign-in is handled by Clerk. The passwords that a site's members and a shared preview's visitors set are hashed with argon2id. Every server action and API route that touches a site's data resolves the caller's tenant and refuses a mismatch, and an automated scan of the codebase fails the test suite when a new action skips that check.

Secrets live in the server's environment configuration rather than in a managed vault, database access is held by the one operator, and there is no staging environment. We are one person and one machine, and we describe it as that rather than as an access-control programme.

Every push and pull request runs the linter, the type checker, the test suite, the build, a migration check and a secret scan. Production dependencies are audited on each run; an advisory that no one has reviewed fails the pipeline, and the ones we knowingly carry are listed by name, with the reason and the change that would close each, in the file security/audit-allowlist.json in the repository.

In August 2026 a security specialist working with us ran a penetration test against the platform and the findings were closed. That was an internal exercise, not an independent external audit, and it is one test rather than a recurring programme; we will say so until it is one.

Card details never reach Cliux. Your plan is paid through Stripe Checkout on Stripe's pages, and what your visitors pay you goes through Stripe Checkout into your own Stripe account, so the card data environment is Stripe's rather than ours.

• No SOC 2 report and no ISO 27001 certificate; we have not been audited against either. If your procurement needs one, we are not the right platform yet.
• No second region, standby server or staging environment.
• No web application firewall or DDoS product beyond what the host provides.
• No bug bounty; we thank researchers, we do not pay them yet.

If you find a vulnerability, tell us through the contact form. Give us a reasonable time to fix it before you publish anything about it. We answer every report, and we credit researchers who want to be credited.