Security

Every Site is sandboxed

Each Site runs as its own user, in its own sandbox. One Site can't read another's files, data or secrets. Live and Preview run as separate services.

No passwords

You sign in with a code sent to your email. There's no password to leak or reuse. Git uses short-lived tokens issued by hm, so there are no SSH keys or passwords to manage.

Secrets stay on the server

API keys are stored outside your code and Git history. Values can't be read back once set, and they're hidden in logs.

Preview is private

Only you and your agent can see Preview, so unfinished work and test data stay private.

Limits on the network

Site code can't reach Haume's internal systems or private networks. Trial Sites can't make outbound connections at all, which stops the platform being used for abuse.

HTTPS everywhere

Every Site and custom domain gets an HTTPS certificate automatically.

In New Zealand

All servers are hosted in New Zealand.