Explore Backify

Trust center

Evidence first.
No badges we haven’t earned.

Everything a security or compliance reviewer needs to evaluate Backify in one place: how the platform is built, where data is processed, what we have and have not certified, and which documents you can review today.

Request security documentationSecurity & governance overview

Backify is operated by Firesub AB, Västerås, Sweden. Last reviewed November 2026.

Security architecture

Clear trust boundaries between who decides, who deploys and what runs.

Backify separates the people who build and approve, the control plane that authorizes, the worker that deploys, and the application that runs. Each boundary has its own identity and permissions.

Trust boundaries

People and teams
Organization → Workspace → Application → Environment. Developer, Publisher, Approver, Viewer and Auditor roles are assigned at a scope and inherited only by its descendants. Membership alone does not grant app access.
Backify control plane
Authorization, policy, approvals, audit and deployment orchestration. It stays with Backify and is not placed in your tenant.
Deployment worker
The only component that uses the cloud-management identity.
Application runtime
Receives runtime bindings, never cloud-management credentials. The app enforces its own user authorization.

Platform safeguards

  • Tenant-scoped query filters in the data layer, with cross-tenant writes rejected.
  • Authenticated-by-default API routes, backed by a route inventory.
  • HSTS, a Content Security Policy and frame denial on platform web surfaces.
  • Cookies scoped to the exact host, not a parent domain.
  • Secret scanning in CI.
  • Personal data export and account deletion.
  • Self-hosted fonts, so pages do not call third-party font services.

Customer Azure hosting

Three identities. Three different jobs.

When apps run in your Azure subscription (Business and Enterprise), deployment, image publishing and runtime access use separate identities.

01 / DEPLOY

Backify deployment principal

Contributor on the resource group you designate, plus the registry, storage and Key Vault data roles it needs. Used only by the deployment worker. Application code and AI agents never receive it.

02 / BUILD

GitHub CI principal

Pushes images through repository- and branch-specific OIDC federation. CI passes an immutable image digest to Backify.

03 / RUN

Application runtime identity

Registry pull and access to the app’s own resources. Separate from every cloud-management operation.

Review customer Azure deployment

Audit

A record of who changed what.

Audit events are recorded for membership, teams, access, ownership, role changes, connection sharing and deployments. Production releases record the revision so you can roll back.

Audit retention by plan
PlanAudit retention
Starter7 days
Team30 days
Business1 year, with export
EnterpriseCustom, per contract
Platform controls do not secure your business logic. Your app must enforce authorization in trusted server code, scope data to the authenticated user or organization, keep secrets server-side, and have its generated code reviewed.

Data location

Where data is processed, stated plainly.

Application data and Backify’s own records have different boundaries. Review them separately.

YOUR APPLICATIONS

The region you choose

Application resources
Deployed in the supported region you select for the app. On customer Azure hosting, they sit in your own subscription.
Changing defaults
Changing a workspace’s default region does not move existing apps or their data.
External services
AI and integration providers your app uses have their own locations and terms.
BACKIFY CONTROL PLANE

Azure North Europe

Control plane
The live control plane is hosted in Azure North Europe (Ireland).
Other records
Billing, email, source-control and support records involve providers listed in the provider register, with their own locations.
Processing schedule
To be confirmed in the DPA.

No blanket residency guarantee. We do not claim EEA-only processing. Confirm the processing schedule, provider register and transfer safeguards before submitting residency-restricted data.

Compliance status

Where we are today, honestly.

No certifications yet

Backify does not hold a SOC 2 report or an ISO 27001 certificate, and we do not describe the platform as compliant or certified.

No penetration test completed

An independent penetration test is part of the readiness plan below. None has been completed yet.

Help with your own review

A GDPR and data-compliance scan for your apps gives a summary on Starter and Team, and full findings with reviews and evidence on Business. It supports your review; it does not certify your app.

Certification readiness plan

The steps below are planned in this order. No completion dates are committed; each step needs an approved owner, budget and, later, an auditor.

  1. 1

    Foundations

    An owned asset and data-flow inventory, risk assessment, access reviews, incident handling, supplier reviews and tested restoration.

  2. 2

    Independent penetration test

    Testing by an independent party, followed by remediation of the findings.

  3. 3

    External readiness assessment

    An outside review of the controls against the chosen framework.

  4. 4

    Scoped audit or certification

    A formally scoped audit or certification engagement. This plan is not a certification guarantee.

Documents

Review the documents.

Terms, the data processing agreement and the provider register are pre-release drafts, version 2026-10-28, pending legal approval.

Data processing agreement

How Backify processes personal data on your behalf. Pre-release draft.

Read the DPA

Service providers and subprocessors

Microsoft Azure, Resend, GitHub, Stripe and customer-selected AI and integration providers. Pre-release register.

View the provider register

Security and governance

Roles, deployment identities, audit records and the split of responsibilities.

Review security

Service status

A live probe of the public control-plane API, and what it does and does not cover.

Check status
Security whitepaper and questionnaire answers available on request. Email hello@backify.dev with your organization and the questionnaire or framework you use.

Responsible disclosure

Found a vulnerability? Tell us.

Report suspected security issues in Backify to hello@backify.dev with “Security report” in the subject. A dedicated security mailbox is coming; until then, this address reaches the team directly.

  • Describe the issue, where you found it and the steps to reproduce it.
  • Include the impact you expect and any proof of concept.
  • Tell us how to reach you.

Please test responsibly

  • Only use accounts and data that belong to you.
  • Do not access, change or delete other people’s data.
  • Do not run denial-of-service, spam or social engineering tests.
  • Give us reasonable time to fix the issue before you disclose it publicly.

Vulnerabilities in an application built on Backify belong to that application’s owner. Report them to the app’s operator as well.

Questions

Trust center FAQ.

Is Backify SOC 2 or ISO 27001 certified?

No. There is no SOC 2 report and no ISO 27001 certificate. We have a certification-readiness plan, described above, with no committed dates.

Does our data stay in the EU?

We do not make that claim. Your application resources run in the region you choose. The Backify control plane is hosted in Azure North Europe (Ireland), and providers in the register have their own locations. The processing schedule is to be confirmed in the DPA.

Does customer Azure hosting keep all Backify data in our tenant?

No. Application resources and their Azure bill are in your subscription. Backify’s control plane, which handles authorization, policy, approvals, audit and deployment orchestration, stays with Backify.

Can our applications or AI agents access the deployment credentials?

No. The deployment identity is used only by the Backify deployment worker. Applications get runtime bindings and their own runtime identity.

Do you publish an uptime SLA?

No. There is no published uptime SLA or support response time. Enterprise service levels are negotiated per contract. See support and service levels.

Can you complete our security questionnaire?

Yes. Send it to hello@backify.dev. We answer based on what the platform does today and will say plainly where a control is planned rather than in place.

Security review

Bring your questions. We’ll bring evidence.

Request the security whitepaper, send your questionnaire, or set up a call to walk through identities, data flows and audit with your security team.

Request security documentationDiscuss a security review

Start with paid Starter: €19 or $19/month before tax. A 30-day money-back guarantee applies to your first Starter purchase. Compare plans and guarantee terms.