Technical & security overview
How Croft works — and how we keep it safe.
You bring the AI. Croft does the rest. Point an assistant you already use — Claude, ChatGPT, or anything that speaks the open MCP standard — at your croft. It writes the app; Croft versions, builds, deploys, and runs it on a private server that's yours alone, with sign-in, HTTPS, a database, and backups already handled. No AI resold, no lock-in, and your data stays yours.
The AI writes it. Croft runs it.
Your assistant writes the code. Croft is everything after that — a private server that's yours, where your app is versioned, built, deployed, and run, with sign-in, HTTPS, a database, and backups already handled.
One platform: your assistant writes the app, Croft runs it on a server that's yours, and your people sign in securely.
Deliberately boring, proven technology.
Chosen for reliability, not novelty.
A private server per workspace
Every croft is its own dedicated virtual machine — not a shared, multi-tenant pool. Your neighbours can't reach you.
Apps run in isolated containers
Each app is packaged and run in its own sandbox on your server, with its own space and its own database.
HTTPS everywhere, automatically
Every app gets a valid certificate that renews itself — no setup, no expiry surprises.
Zero-downtime deploys
New versions are built and swapped in behind the scenes; requests keep flowing while an update ships.
Everything is versioned
Each change your assistant makes is committed to version history, so any release can be rolled back.
Built on boring foundations
Linux, containers, and a mature web framework — the same building blocks that run much of the internet.
Identity is checked before your app ever runs.
Sign-in and per-app access are enforced at the gateway — so your apps never touch passwords or handle logins.
Your app simply reads who the verified visitor is — it never stores or checks credentials.
Built in at every level — none of it your job to write.
Nothing is bolted on afterwards, and there's no security code for anyone to get wrong.
Real isolation
A dedicated server per customer means one workspace can never see or reach another's apps or data.
Passwordless sign-in
Sign in with a one-time code — there's no password to phish, reuse, or leak.
Auth at the gateway
A dedicated gate verifies identity before any request reaches an app. Apps never store or check credentials.
Per-app access
Decide exactly who can open each app; invite and revoke people in a click.
Encrypted throughout
Traffic is encrypted in transit, and sensitive settings and secrets are encrypted at rest — never kept in code.
Locked-down control plane
The systems that manage the fleet only accept trusted traffic, shielded behind a hardened front door.
& its database
Four concentric layers stand between the public internet and your app and data.
Fast, self-contained, continuously backed up — and always yours.
Each app has its own database living on your own server.
A database per app
Every app stores its data in its own embedded SQL database on your server — simple, fast, and isolated from every other app.
Continuous, encrypted backups
Every change streams to encrypted, off-site storage, so we can restore to any moment in time — not just last night.
Nightly full snapshots too
A second, independent layer of protection on top of the continuous stream.
You own it — take it anytime
Download your entire workspace — code, database, and uploaded files — and run it anywhere. No lock-in.
Data stays on your server, protected by encrypted off-site backups — and is yours to export in full.
Five things to remember.
Bring your own AI
Use the assistant you already pay for. We don't resell AI or meter tokens — and you're never locked to one provider.
A whole running app
Not backend building blocks to wire together — the assistant writes the app and Croft deploys and hosts it, live at a URL.
Your own private server
Genuine isolation on a machine that's yours, not a shared tenancy you share with strangers.
You own your data
Export everything — code, database, files — and walk away whenever you like.
Security & hosting done for you
HTTPS, sign-in, per-app access, backups, and deploys are all handled by the platform. There's no security or infrastructure code for anyone to write.
Stake out your croft.
Your team's first app could be live before lunch.
Get your croft7 days free, no card to start. Then $29/month — cancel anytime and take everything with you.