Security
How Steed protects your site, your data and your customers. This page says only what is true today.
Where your data lives.
Your account, your plan, your site's content and what your customers give your site are kept in one database, hosted in the United States, encrypted where it's stored and on its way there. Your published site holds no database keys of its own.
Your business is kept apart from every other.
Every table that holds your data is locked to your account in the database itself, with row-level security. A test proves it for every table each time Steed's database changes, and a new table can't be added until it passes.
Payments go straight to you.
Your customers pay your own Stripe account, through Stripe's payment form inside your checkout page. Card numbers never reach Steed. Steed takes no fee from your sales. When Stripe tells Steed about a payment, Steed checks the message is really from Stripe and reads the payment back from Stripe itself before acting on it.
Members come from your Stripe.
A person becomes a member of your site only through your own Stripe: when Stripe confirms their payment, or on terms you set there, like a free trial or an invoice. Your site can read who is a member; only your Stripe makes one. Members sign in with a 6-digit code emailed to them, which works once, lasts 10 minutes and can be tried only a few times.
Your keys stay secret.
When you connect a service with a key, such as your Shippo account, Steed seals it with AES-256-GCM, bound to the site it was saved for, before it's stored. It's opened only on Steed's server, only to call the service it was saved for, and never sent to a browser or placed in your site's pages. You see only its last four characters. If you paste a key into chat by mistake, it's cut out before the AI or our records see it.
Your site is built in a sealed computer.
Each build runs in its own sealed computer, made fresh for that build and shut down when it's done. Nothing from another customer's build is ever beside yours. It can reach only what the build needs: the software it installs, fonts, Steed's own services, your site and the sites you named for your look, and your own Stripe in test mode, through Steed, on a key that ends with the build.
Backups.
Everything is backed up every day, and each backup is kept for seven days.
Your code is yours.
Once your site has been Live, you can download its code from your settings, including after you end Live. Once you delete a site, Steed deletes it and its code. It leaves our backups within seven days, and we keep only the cost of the work done for it.
The technical detail.
For you, or for the person who looks after your IT.
- In transit. Every Steed address and every site Steed builds is HTTPS only. Your site tells browsers to use HTTPS for a year (HSTS) and upgrades any insecure request. Steed's own connections to its database are encrypted and check the database's certificate.
- At rest. The database and its backups are encrypted at rest with AES-256. Keys you connect are sealed again with AES-256-GCM, each bound to the site it was saved for, so it can't be opened for any other.
- Database access. Steed's app holds no master key to the database. Every request from your site or your account runs as the person signed in, or as a worker held to the one site it's working on, and row-level security in the database decides what each can read or change. A few of Steed's own background jobs read across sites, to count usage and keep things running.
- Payments. Card details go from your customer's browser straight to Stripe, which is certified PCI DSS Level 1; they never pass through Steed's servers. Every payment notice from Stripe must carry a valid signature and arrive within five minutes, a repeated notice is ignored, and the payment is read back from Stripe before anything changes.
- Your site's pages. Every site carries security headers: a content security policy that limits which scripts run and which pages may frame it, and a referrer policy so other sites see only your address. Steed's security check reads them on your live site and puts back any that are missing.
- Signing in. You sign in to Steed with a code emailed to you or with Google; there are no passwords to steal or reuse. Steed's own pages can't be shown inside another site, so no one can trick you into pressing a button there.
Report a problem.
If you find a security issue, write to support@steed.biz with Security in the subject. Steed is watched around the clock by automated alerts, and a person reads every report.