Clear boundaries, stated plainly.
The preview is designed to fail closed around identity, tenant access, mutation authority, and recovery integrity.
Identity
Passkeys protect browser accounts. Sessions use host-only HttpOnly cookies. Scoped API keys are shown once and stored as keyed digests.
Tenant boundary
One Firecracker VM per supported database. PostgreSQL roles or SQLite authorizer policy are server selected, and cross-tenant resources return not found.
Private origin
PostgreSQL, SQLite guests, and origin services are not public. Cloudflare reaches fixed private services through an outbound tunnel.
Recovery integrity
Encrypted, checksummed base/WAL objects publish immutably. Restore fails closed on gaps, corruption, wrong engine or generation, and mismatched recovery identity.
Measured, not promised
Historical development samples measured about 4.26 seconds for a first SQL request after a cold R2 restore and about 194ms while hot. They are measurements, not latency guarantees.
The service still has one Helsinki metal failure domain. It is not a hardened multi-host fleet, multi-region system, automatic-failover service, or suitable home for regulated, safety-critical, or irreplaceable data.
Keep your own export of anything important. Report security concerns privately to support@ondemanddb.app.