Security by design.

Four isolation zones keep untrusted software away from your data.

Four zones.

Zone 1

Static catalog served from the edge. No user secrets, no server state.

Zone 2

Authenticated APIs with rate limits, input validation and audit logs.

Zone 3

Pricing and cost engines. Deterministic code only, no model output in money paths.

Zone 4

Playground and demos. Third-party content runs in sandboxed frames or isolated sessions.

Outbound fetches use an allowlist, block private and link-local ranges, and re-check DNS after resolution.

We embed a site only when its own headers allow it. We never strip X-Frame-Options or CSP.

Content from apps is treated as data, never as instructions. Tool calls need an allowlist and approval.

Partner callbacks require HMAC-SHA256 signatures and timestamps to block replay.

Every privileged action is logged. One switch disables embeds and partner redirects site-wide.

AppDir stores metadata and official links only. We never host APK or EXE files.