How Haechy fences in each app

An app has no route to the internet of its own. Its only way out is Haechy's outbound gateway, which lets a connection through only if the host is on that app's approved list. Everything else is refused and logged.

• Claude can ask for a host, with a reason in plain words. Only the workspace owner or an admin can approve it, by opening the request in the Haechy console while signed in. Claude can't approve its own request.
• An approval covers one host for one app. Your other apps stay as they are, and you can turn an approval off at any time.
• Blocked attempts are recorded and Claude can read them, so it can explain what the app tried to reach and ask properly.
• Package registries are open only while the app is being built; a running app can't reach them.

Apps run in containers under gVisor, which puts its own kernel layer between the app and the server it runs on. Each app also gets its own private network.

• The file system is read-only, apart from a temporary folder.
• The app runs as an ordinary user with every Linux capability removed and no way to gain more.
• Memory, processing and the number of processes are capped to the plan.
• The app never listens on the internet directly. Requests reach it only through Haechy's sign-in gateway.

Haechy checks who someone is before their request reaches the app. A new app is open only to you and the people you add. You can widen it to everyone in your workspace. On paid plans you can also open it to anyone with an email address at your company's domain, or open a page to the public.

Colleagues sign in with a link sent to their email; they don't need a Haechy account. Haechy then tells the app who they are, so Claude never has to write a login system, which is one of the easiest things to get wrong.

Apps live on haechy.app, a separate domain from haechy.com, so an app can't read or set cookies for Haechy's own site.

Each app gets its own Postgres database with its own login, which can connect to that database and no other. The database is backed up every night. Free keeps 7 days of backups; paid plans keep 30 days of nightly backups and 90 days of weekly copies (see plans). On every plan you can restore a backup by asking Claude; how restore works.

Keys and passwords for outside services are stored as app settings, outside the code, and handed to the app when it starts.

Every time Claude deploys, Haechy runs an automated check on the code before it goes live. It looks for these three things:

• Keys or passwords written into the code. These stop the deploy until they move into app settings.
• A .env file in the files being deployed. This also stops the deploy.
• Outside services the code mentions, listed with whether each one is approved yet.

It is an automated check of those three things. It does not check the packages the app uses, and it doesn't replace a careful look at what the app does.

Each app lives in one region. Its container, its database and its backups are all there. You choose the United States, the European Union, the United Kingdom or Australia.

Some things are not tied to your app's region. Your Haechy account, sign-in and billing run on Haechy's control plane in the US. The full list of what lives where.

Some services we use to send email, verify phone numbers and take payments process data outside your chosen region. See our sub-processors.