Overskill Overskill
Log in Sign up & build

Security at Overskill

We implement industry-standard security controls and leverage enterprise-grade infrastructure to protect your data and applications.

Last updated: October 15, 2026

Infrastructure Certifications

Inherited Compliance Model

Overskill is hosted on Render, a platform with SOC 2 Type II and ISO 27001 certifications. This means our infrastructure inherits enterprise-grade security controls that have been independently audited. We leverage Render's security investments while implementing additional application-level protections.

SOC 2 Type II

via Render

Security controls validated by independent audit over 6+ month period

View on Render Trust Center

ISO 27001:2022

via Render

International information security management standard

View on Render Trust Center

Security Practices

Encryption

  • TLS 1.3 encryption for all data in transit
  • AES-256 encryption for data at rest
  • Automatic HTTPS enforcement on all endpoints
  • Managed SSL/TLS certificates via Render

Access Controls

  • Role-based access control (RBAC) for team members
  • Team-based resource isolation (BulletTrain)
  • OAuth 2.0 with Google and GitHub

Infrastructure Security

  • Hosted on Render (SOC 2 Type II certified)
  • Platform database on Amazon Aurora (AWS)
  • Built on AWS and Google Cloud Platform
  • DDoS protection and globally distributed edge delivery via Cloudflare

Security Monitoring

  • 24/7 infrastructure monitoring via Render and Cloudflare
  • Comprehensive audit logging for administrative actions
  • Security incident response process

Application Security

  • On-demand security review in the publish flow: scan your app for common vulnerabilities (exposed secrets, unsafe HTML, input validation) before you deploy
  • Deploy is gated on critical findings until you review them
  • Dependencies kept current on a managed, regularly updated platform

AI Security

  • Prompt injection filtering on all user inputs
  • Content moderation on AI-generated outputs
  • No training on customer data
  • Isolated AI processing per request
  • Rate limiting on AI operations

Security Vulnerability Disclosure

We take security seriously and appreciate the responsible disclosure of potential vulnerabilities. If you discover a security issue, please report it to us privately.

[email protected]

Please include a detailed description of the vulnerability, steps to reproduce, and potential impact. We aim to acknowledge reports within 48 hours and provide regular updates on our investigation.

Data Protection

Data Processing Locations

  • Platform services: Render · Oregon, USA (US West)
    The Overskill web app, background processing and caches
  • Platform database: Amazon Aurora on AWS · AWS us-west-2 (Oregon, USA)
    Accounts, workspaces, chat history, app source code, support and billing records
  • App databases: Cloudflare D1 · North America
    Data collected by apps you build; the default for new apps
  • App databases (older apps): Turso · AWS us-east-1 (Virginia, USA)
    Apps created before September 2026 that have not moved to Cloudflare D1
  • File storage: Cloudflare R2 · Eastern North America
    Uploads, app assets, screenshots and database backups
  • Published apps: Cloudflare · Global
    Served from Cloudflare's network, close to each visitor
  • Build and preview environments: E2B · USA (Google Cloud)
    Where your app is built and previewed while you edit it
  • Email from your app's custom domain: Amazon SES on AWS · AWS us-east-1 (Virginia, USA)

Overskill does not currently offer in-region data storage (for example, EU- or Japan-resident storage). Our databases and file storage are in North America, as described above.

Data Retention

  • Account data retained while account is active
  • Generated apps can be exported or deleted at any time
  • Deleted data removed within 90 days (backup rotation)
  • Audit logs retained for 90 days