HealkiteDocs
Dashboard GitHub Action

Security

Healkite is built so that a compromised server or CDN still can't run code on your users' phones.

Update integrity

  • Your signature on every bundle. Bundles and patches are signed with your ECDSA P-256 key, which never leaves your machine or CI. Apps with HealkitePublicKey verify the signature before downloading and refuse anything else.
  • Server-signed manifests. Apps with HealkiteManifestKey refuse unsigned or altered manifests and anything older than the newest one they accepted, so nobody can replay an old release, downgrade users or fake a kill switch.
  • Hashes on every file. Each file is checked against its sha256 after download or patching, and paths are sandboxed to the app's update directory.
  • Crash-safe installs. A bundle that doesn't reach notifyAppReady() is rolled back on the device.

Data we collect from devices

A random device id generated by the SDK, platform, app and bundle versions, install and rollback events, fatal JS error messages and the events you send with trackEvent. No names, emails, IPs stored with events, advertising ids or location. Don't put personal data in trackEvent properties.

Accounts and access

  • Dashboard sign-in with GitHub OAuth or your identity provider (SSO); invite-only per organization.
  • Roles (Owner, Admin, Developer, Viewer) for people and API keys; every endpoint checks the permission it needs.
  • Access keys are stored as hashes. Firebase credentials are encrypted with AES-256-GCM.
  • Billing data stays with our payment partner; we store only the plan and subscription id.

Infrastructure

Healkite Cloud runs on Cloudflare Workers, D1 and R2 with TLS everywhere. Bundles are content-addressed and immutable. If you need full control, self-host the same code on your own infrastructure.

Compliance

Healkite Cloud is not SOC 2 certified yet. Enterprise customers can request a security questionnaire, or self-host so update data never leaves their infrastructure.

Reporting a vulnerability

Email hello@healkite.com with "Security" in the subject. We reply within two business days and credit reporters who want it.