Skip to content

Security

Private by default, and built to stay that way.

Appholm hosts software written by other people, so its design starts from what could go wrong. This page says what is in place today, and what is not yet.

How it is built

Six things that are true of every app.

  • Sign-in on every app

    No app opens without your Microsoft Entra sign-in. There are no public links, and guests from outside your organisation are off until your policy allows them.

  • One address per app

    Each app is served from its own address, so one app cannot read another’s cookies or storage. Apps never run on the address that serves the console.

  • Admins are on the access list too

    The access list applies to everyone. IT can see that an app exists, who owns it, and who can open it. Opening it still needs the owner to give access.

  • An audit log nobody can edit

    The log refuses changes and deletions, and each entry is chained to the one before it. Exports carry the hashes, so an auditor can check the chain.

  • Access removed is access gone

    When an owner removes someone, the app stops opening for them within seconds and their browser is told to clear what it kept.

  • Apps keep serving

    If the console is unavailable, published apps carry on working for people who are signed in. New sign-ins and new versions wait until it is back.

In practice

What is in place today.

In place

  • Run in the UK by Ether-X LtdRegistered with the Information Commissioner’s Office, number ZC138203.
  • Uploads are checkedSize limits, checks on every file in a zip, and a strict content policy on every app.
  • Short-lived sign-ins to appsA sign-in to an app lasts an hour, works for that app only, and can be revoked.
  • Sharing rules set by ITInside the company, with guests, and apps marked confidential: each can be allowed, reviewed, or blocked.

Not yet

  • Independent penetration testPlanned before container apps arrive, because that is when Appholm starts running code rather than serving files.

Questions from your security team?

Ask us. We will answer plainly, and say so when the answer is “not yet”.

Ask a security question