Security & Architecture
Your app runs in your customer's AWS account.
Architecture: the application, its database, cache, file storage, and secrets run in the customer's AWS account. The Deployz connector, which the customer launches as a CloudFormation stack, also runs there. The connector starts every request to the Deployz management service over outbound HTTPS, receives deployment instructions, and reports status. Deployz makes no inbound connections and never asks for AWS access keys.
Your customer approves AWS access.
- The customer can review every requested IAM action before connecting.
- Most write actions are limited to resources tagged for the installation. The connector role has a permissions boundary; the CloudFormation role that creates app resources does not.
- The connector cannot read application logs.
The connector can:
- Create a dedicated network (VPC), load balancer, and security groups
- Run the application on Amazon ECS
- Create the database, cache, and S3 bucket your app needs
- Create IAM roles for the application and AWS services
- Read and write secrets tagged for the installation
Who is responsible for what
- Deployz
- Supported infrastructure, deployments, updates, rollbacks, and status.
- The SaaS vendor
- Application code, configuration, data handling, and integrations.
- The AWS account owner
- AWS account administration, billing, access, and governance.
Hosting in customer AWS does not by itself make an app compliant or secure.
What Deployz receives
Deployz receives
- Installation ID, AWS account ID, and Region
- Connector, release, and image versions
- Deployment state, health, and timestamps
- Resource IDs and AWS error messages
- Health-check status code and response time
Deployz does not receive
- Database data
- Cache contents
- S3 data
- Application logs
- In-memory app data
Secrets
Held encrypted until the customer's account connects, then delivered to AWS Secrets Manager there. Values you set for every customer stay encrypted in Deployz.
Code and AI
Repository access is read-only. Release images are built in Deployz’s AWS account. AI may read redacted repository excerpts, but it never creates infrastructure.
Network routing
Traffic to the default deployz.dev URL passes through the Deployz proxy on Cloudflare. A custom domain goes directly to the customer's load balancer.
Built on audited infrastructure
The Deployz API, database, builds, and image registry run on AWS services covered by the AWS SOC 2 Type II report. DNS and the default-URL proxy run on Cloudflare services covered by its SOC 2 Type II report.
Is Deployz SOC 2 certified?
No. Deployz has not completed its own SOC 2 audit. A Deployz SOC 2 Type II examination is planned. Provider reports cover only the providers’ own controls.
Does AI have access to customer AWS accounts?
No. Every change in a customer account goes through the customer's connector.
After deployment
Updates and rollbacks
You start each update; nothing updates automatically. If a new version fails, the previous one keeps running. Rollbacks do not reverse database migrations.
Removal and retained data
Removal deletes the app and most infrastructure but keeps the database, its credentials, and the S3 bucket, which still cost AWS charges. Deleting them is a separate, confirmed step.
Removing the connector
The customer deletes the connector stack to end Deployz access. Remove the deployment first; afterward Deployz cannot change the app.
If Deployz is unavailable
The app keeps running, and installs and updates pause. New app tasks pull images from the Deployz registry. The default deployz.dev URL needs the Deployz proxy; a custom domain does not.
Deployz is built by Thalia Technologies, the team behind CSVBox, Spreadr, and other SaaS products.
Check what your app needs before you promise a customer.
Connect GitHub for a free readiness report.
Get Started Free