Going live, addresses and security
The security screen
Two switches, and a list of what is protected whether you open this screen or not.
The two switches
- Embedding in other sites — blocked by default. Open it only if you are embedding the site yourself, in another site of yours.
- Camera, microphone and location — if your site films, records or uses location, leave it open; otherwise the browser simply will not let it ask.
What is always protected
- Your site sits on a separate domain name from the system, so code running in it cannot touch your account here.
- Every table's permissions are enforced on the server on every request — even if somebody calls it directly rather than through the site.
- Users' passwords are stored hashed and nothing else. We cannot read them either.
- A session token from one app means nothing in another.
- The site can call our server and nothing else — no external address at all.
There is no switch here that turns off a protection the product rests on. These are not preferences, so they are not presented as preferences.