Infrastructure
Rimbra runs on Oracle Cloud Infrastructure in Frankfurt, Germany, with email delivery and a standby server at Contabo in the European Union.
Storage volumes are encrypted at rest by our cloud provider.
Encryption in transit
Every Rimbra address and every connected domain is served over HTTPS with automatically issued certificates. The dashboard uses HSTS. Database connections from outside Rimbra are TLS-only.
Isolation
Builds run in sandboxes with access only to their own project's files. Each workspace's data is kept separate. Customer sites are served from their own domains (rimbra.live, rimbra.xyz, rimbra.click), apart from the Rimbra dashboard.
Accounts and access
Passwords are stored as salted, stretched hashes, never in plain text. Two-factor authentication is available for every account, and sign-ins from new devices are emailed to you.
Sessions use secure, HTTP-only cookies. Team members get roles, and API and agent keys are scoped and can be revoked at any time.
Inside Rimbra, production access is limited to the people who need it, and secrets are stored outside the codebase.
Backups and resilience
The control database is backed up every 15 minutes and copied to a second provider. Managed databases can be backed up and restored from the dashboard.
Monitoring and abuse prevention
We monitor service health publicly at status.rimbra.app, rate-limit sign-ins and APIs, and automatically block abusive traffic. Abuse reports go to abuse@rimbra.app.
Responsible disclosure
If you find a vulnerability, email security@rimbra.app with the details and steps to reproduce. Give us reasonable time to fix it before telling anyone else, and don't access other people's data, degrade the service or run automated scans that affect customers.
We won't take legal action against good-faith research that follows these rules, and we'll credit you if you'd like.