When you put your app on a shared platform, the first question is not “how fast is it?” It is “what can the other customers’ apps reach?” This is how we answered it when we designed KoedoDB. Everything here is a design we are building toward launch, not a claim that it has been audited.
One project, its own boundaries
Every project gets its own namespace, its own database, and its own keys. Nothing is shared by default: not the database, not the JWT keys, not the secrets.
Your code runs in a sandbox
Your application code does not run directly on the host’s kernel. Functions and static hosting run in a sandbox on shared infrastructure, and your Compute service runs inside a sandbox or a lightweight virtual machine. If a bug in a customer’s app lets someone run code, it has to get through that wall first.
The network is closed by default
A project starts with no way to talk to other projects. The network policy allows only what the project needs, and everything else is denied.
- Your database can reach DNS and the object storage that holds its backups, and nothing else. A database that cannot call out is much harder to turn into a foothold.
- Your app can reach the internet on the ports apps normally use (web and mail), but not other projects, the platform’s control services, the node, or private networks.
Databases and your code are separate workloads
Your database and your application code are separate workloads. The database runs on its own dedicated microVM, your code runs in its own sandbox, and each has its own network rules. A problem in one is not automatically a problem in the other.
Secrets and backups follow the same rule
Each project has its own encryption key, and each secret is encrypted separately. Backups are encrypted with a key that belongs to the project. By design, deleting that key makes the project’s remaining backups unreadable, to us as well.
What this does not do
Isolation limits the damage when something goes wrong. It does not replace writing your app carefully, and Row Level Security is still yours to configure. We would rather say that plainly than leave it out.