The distribution layer is not the trust anchor.
Your signing identity remains between your CI and your application. Releases transports signed artifacts and framework manifests without taking custody of the private key.
Trust stays end to end.
The platform is designed around passthrough signing: each participant has a narrow, explicit responsibility.
- 01
Build pipeline
Builds and signs each artifact using publisher-controlled keys.
- 02
Releases
Stores the artifact and signature, then delivers the updater response and binary.
- 03
Installed app
Verifies the signature against the public key compiled into the client.
Narrow access and bounded delivery.
Security controls are attached to the organization, app, release, and artifact boundaries used by the product.
Scoped publishing
Publish keys are app-scoped, stored as hashes, rate limited, rotatable, and revocable.
Tenant isolation
Dashboard data and product operations resolve through the active organization and server-side authorization.
Artifact delivery
Objects are encrypted at rest, transported over TLS, and downloaded through short-lived signed URLs.
Upload safeguards
Publishing enforces metadata and artifact limits, reserves quota safely, and verifies every object and byte count before release.
Collect less on the public surface.
The marketing pages ship without third-party analytics or non-essential cookies. Product metering is limited to operating release delivery, enforcing plan allowances, and reporting organization usage.
- No advertising trackers on the Releases marketing pages
- Optional storage stays off until a visitor makes a choice
- Organization-scoped product and billing records
- Defined rolling or archive retention for release binaries
- Support for custom-domain ownership verification
This overview explains the safeguards applied to release publishing and delivery. Privacy, service, acceptable-use, billing, and data-processing terms are available in the legal center.
Ship through a trust model you can explain.
Keep private keys in CI, publish signed artifacts, and let every installed client verify the result.