Platform Security quickstart

Protection built into every layer. Most of it is on before you do anything; this is the short list of what to check.

Prerequisites

A SetCloud account.

Email-and-password accounts require an authenticator app. Set it up when prompted during sign-in, then enter its current six-digit code. In the dashboard, Settings → Security also offers an additional SMS verification option. Remembering a browser for SMS does not skip the required authenticator step. See the sign-in verification guide.

2. Check your TLS

Use Projects → your project → Domains to verify ownership, DNS validation, and certificate status. Keep validation records in place for automatic renewal.

3. Keep credentials out of your code

Store API keys and connection strings in the Secrets Vault. They’re encrypted at rest and injected at deploy time, never committed.

4. Know your isolation

Your workloads run isolated from every other tenant’s — your own logical database and login role, network rules scoped to your services, and a cloud identity that can read only your secrets. That’s the default, not a tier.

5. Review your posture

Use Settings for account security, Activity for recorded events, project Domains for HTTPS status, and project Security for firewall and bot controls. There is no combined posture-report page.

Secrets quickstart — the vault in five minutes.
Bot Protection quickstart — for the traffic you don’t want.