Who can change or publish an app?
Scoped roles let you distinguish building, publishing, approval, and review. Release approvals and region policies are available on Business; confirm the plan and assignments you need.
Confidence at every stage of growth
Move faster.
Know who has control.
Small teams need clear ownership. Growing businesses need scoped access. Enterprises need evidence for review. Backify brings roles, deployment controls, and audit records to your AI-built software—with explicit boundaries between platform and application responsibilities.
Start with paid Starter: €19 or $19/month before tax. A 30-day money-back guarantee applies to your first Starter purchase. Compare plans and guarantee terms.
What to evaluate
Confidence starts with clear responsibilities.
Use these questions to decide whether Backify fits your organization, then review the detailed boundaries below.
Where is our information processed?
Review application hosting separately from control-plane, billing, and support data. Choosing a region is one part of the review, not a blanket residency guarantee.
What must our team implement?
Backify supplies platform controls. Your builder must still implement and test application authorization, validation, business rules, and appropriate data access.
Access by scope
The right access for the work at hand.
Backify organizes resources as Organization → Workspace → Application → Environment. Prefer ordinary membership plus scoped assignments.
OrganizationWorkspaceApplicationEnvironment
- Membership
- A Member belongs to the organization without automatically receiving application access.
- Assignments
- Grant Developer, Publisher, Approver, Viewer, or Auditor roles at the scope needed for the job.
- Inheritance
- A grant applies to its resource and descendants—not siblings or ancestors.
- Ownership
- An owning team records accountability. It does not replace permission assignments.
Credentials outside application code
Separate the identity that deploys from the identity that runs.
Customer Azure deployments distinguish deployment, image-push, and runtime access.
Deployment principal
Performs cloud-management operations through the Backify worker. Application code and AI agents do not receive this deployment identity.
GitHub CI principal
Uses repository- and branch-specific federation and application-scoped publishing access for the connected workflow.
Runtime identity
Uses runtime bindings and its own resource access. Your application must still check what each user is permitted to do.
Platform permissions do not secure your business logic. Enforce authorization in trusted server code, scope data to the authenticated user or organization, keep secrets server-side, and review generated code.
Evidence for your security review
Give your security review something concrete.
Membership, teams, access, ownership, role changes, and connection sharing generate audit events. Use those records alongside deployment activity.
Review with your security team
- Confirm identity and role-assignment boundaries.
- Review application and control-plane data flows separately.
- Check approval requirements and production publishing grants.
- Define retention, contractual, and incident-handling requirements.
Ask for evidence, not a badge.
Does customer Azure hosting mean all Backify data stays in our tenant?
No. Application resources and cloud billing sit in your subscription. Backify retains its control plane for authorization, policy, approvals, audit, and deployment. Review its data flows separately.
Are certifications or regulatory compliance guaranteed?
This page describes product controls, not a certification or regulatory guarantee. Ask for current evidence and review your organization’s requirements before approving adoption.
Data location and assurance
Review the evidence before production use.
The checked-in control-plane infrastructure defaults to East US 2 in the United States. This is a template default, not verification of the current deployment. Application resources use their selected region; control-plane, billing, support and third-party records have separate locations. Confirm the deployed inventory and transfer safeguards in the provider register and processing schedule before submitting residency-restricted data.
Certification readiness plan
No SOC 2 report or ISO 27001 certificate is claimed. The proposed assurance program starts with an owned asset and data-flow inventory, risk assessment, access reviews, incident handling, supplier reviews and tested restoration. Next steps are independent penetration testing and remediation, an external readiness assessment, then a formally scoped audit or certification engagement. Completion dates and audit commitments require an approved owner, budget and auditor; this plan is not a certification guarantee.
Processing agreement · Support and service levels · Monitoring scope
Security evaluation
Move your security review forward.
Talk through identity, hosting, data boundaries, and the evidence your organization needs to evaluate Backify. Review the controls before you expand adoption.
Start with paid Starter: €19 or $19/month before tax. A 30-day money-back guarantee applies to your first Starter purchase. Compare plans and guarantee terms.