Limits and security

What runs underneath your project, which limits apply and where your data is stored.

#Plans and limits

The plan is chosen per project, and your account pays for all your projects.

Yearly, you pay for 10 months and get 12. Your account's first project gets 14 days free; your card is charged only when the trial ends. During the test period everyone can have up to three projects for free, and the storage quota is 2 GB per project. Storage is counted on the database and uploaded files together; snapshots are not counted. If you approach the limit you get an alert — nothing is shut down without warning.

#Each project in its own box

• Its own process and its own user. A project cannot read another project's files.
• Its own storage volume with a hard quota. If you fill it, you hit your own ceiling, not your neighbour's.
• Caps on CPU and memory: one CPU core and 512 MB of memory per project. A project that runs away is stopped at its own cap.
• The project never goes to sleep. Scheduled jobs (cron) always run.

#Outbound traffic

Your project can reach the web (HTTP and HTTPS), DNS and mail servers via encrypted submission (ports 465 and 587). Port 25 is always closed — a single hijacked project sending spam must not be able to ruin the sender reputation for everyone else. All other outbound traffic is blocked, and private networks — our own network, routers and other servers — are never reachable from a project.

#Inbound traffic

The server has zero open ports to the internet. Traffic comes in through an encrypted tunnel from Cloudflare. Unknown addresses respond 404.

#Visitor IP address

Behind Cloudflare and the tunnel, PocketBase would see the same address for all visitors. That is why Zkrinet's base layer turns on PocketBase Trusted proxy for the CF-Connecting-IP header, which Cloudflare sets. This lets rate limits, statistics and blocks see each visitor's real IP.

• If you have set something yourself under Settings → Trusted proxy, we don't touch it.
• If you run the project somewhere else after an export, the setting is turned off automatically, because a visitor there could otherwise spoof their IP.

The base layer is one file, pb_hooks/zk_zkrinet.pb.js, which is added to all projects. It is visible in the export and can be read.

#Encryption

• At rest: every customer volume is encrypted with AES-256.
• In transit: HTTPS to Cloudflare and an encrypted tunnel on to the server.

#PocketBase version

Every project runs the official PocketBase binary, unmodified, in the version the project was created with (today 0.40.4). The version is locked — nothing is upgraded behind your back. Choosing a new version yourself COMING.

#Where your data is stored

• Your project — database, files and code — is on our own servers in Sweden.
• The traffic passes through Cloudflare, which therefore sees visitors' IP addresses and the content of requests as they pass.
• Your account and operational data (which projects you have, alert settings) are stored with Supabase in Stockholm.
• Payment is handled by Stripe through Stripe Managed Payments: Stripe (Link) sells the service on our behalf, charges VAT and sends the receipts. Stripe receives your billing details; the card number never reaches us.

The full list is in the privacy policy.

#Backups

Today a snapshot of the whole project is taken before every deploy and every building block change; the snapshots from the three most recent deploys are kept. They live on the same server as the project and protect against failed changes, not against the server breaking.

Continuous backups are not included yet. Until we offer them, you are responsible for backing up your data (terms, section 7). The easiest way is PocketBase's built-in backups to your own S3 bucket at a provider you choose, see Backups to your own S3. You can also take an export whenever you like. Continuous backups from our side are COMING — we will tell you by email when they exist.

#PocketBase activity log

By default PocketBase stores the IP address and browser for every request in its activity log (Logs in the admin panel). That is PocketBase's own behaviour. If you don't want that: change the log level or how long logs are kept under Settings → Logs. Remember to mention it in your own privacy policy.