Isolation

Generated code is untrusted code. Qyant is built on that assumption.

Every project in its own container

Each preview and each deployment runs in its own container. Containers are created with:

• gVisor (runsc) as the runtime — a user-space kernel that sits between the container and the host kernel, so a kernel exploit inside your app doesn't reach the machine.
• All Linux capabilities dropped and privilege escalation disabled.
• Hard limits on CPU, memory and number of processes.
• A non-root user inside the container.
• Read-only system files; writable space is a size-capped scratch area.

Network

Containers reach the internet (to install packages and call the APIs you use) but not Qyant's own control plane, and not each other's ports. The database host is pinned by address; there is no service discovery to enumerate.

Database

Each project has a dedicated Postgres database and role on a cluster used only for project databases. The role cannot see other databases. Qyant's own data lives on a different cluster entirely.

Previews

A preview URL answers only to the signed-in owner of that project; every request is checked against the session and the project. The preview proxy strips cookies the app might set so nothing can collide with your Qyant session, and prevents the app from being embedded anywhere except the Qyant builder.

Thumbnails

The screenshots on your project cards are taken by a headless browser that renders your app with its own sandbox enabled and can only load resources from the app itself and public asset hosts — never from Qyant's internal network.

What we don't claim

Qyant is not currently SOC 2 or ISO 27001 certified. If a certification is a requirement for you, tell us; it shapes our roadmap.