Security
Solta serves code other people wrote. Most of what follows is about keeping that code away from everything else.
Two domains, on purpose
The product lives on solta.now. Published sites live on solta.site, and every site gets its own hostname there.
That is not cosmetic. A published site is markup someone else wrote, running in your browser. On its own origin it cannot read your Solta session, cannot read another site's storage, and cannot act as you. The browser enforces that, not us.
Password fields for private sites are always on solta.now — never on the origin serving somebody else's JavaScript.
What a published site may do
Every site is served with a strict content security policy built from its own settings. Scripts load only from Solta and a pinned package host; framing is limited to the domains the owner listed. Nothing else can put a site in a frame.
Solta serves static output. There is no server running your code, which removes a whole category of problem: no shell, no filesystem, no credentials to steal.
Before anything is served
Every version is checked before it goes live: for secrets accidentally left in the file, for credential-collecting sites, for miners and obfuscated code. Anything the checks cannot decide goes to a person rather than through.
If you paste an API key, we refuse the file and tell you where it is. We would rather annoy you than publish it.
Apps you connect
Claude, ChatGPT or your own script can publish on your behalf. Whichever route it takes, it reaches the same public API you would — there is no separate agent path into your account, so an app cannot touch anything you could not touch yourself.
A connector goes through the ordinary authorisation flow: it registers itself, we send you here to sign in, and you see what it is asking for before you agree. Access lasts an hour. The refresh alongside it is rotated on every use, dies if it is ever presented twice — which means somebody else has a copy — dies after a month unused, and ends ninety days after it started however busy it has been.
Keys are for scripts, shown once, and stored as a hash: a leak of our database is not a list of working keys. Neither a key nor a connector can act as staff, because removing somebody's site is something a person is accountable for.
Everything you have connected is listed in your settings with the date it was last used, and disconnecting takes effect immediately — on every token that app is holding, not just the next one.
Where your data is
- Compute and databases in Germany.
- Files under EU jurisdiction.
- Backups nightly, kept 30 days, and restored into staging to check they work.
- Access logs 30 days.
- Visits to solta.now's own pages are counted by DataFast, outside the EU, and only with consent. It never runs on the sites you publish.
The full list of who else touches your data is on the sub-processors site, and we give 30 days' notice before it changes.
Telling us about a problem
Write to security@solta.now. We reply within two working days, we will not threaten you, and we will credit you unless you would rather we did not.
Please do not test against other people's sites. Publish one of your own and test against that — it is the same code path.
Solta is a small team. This site says what is true today rather than what sounds impressive; when something changes, it changes here.