Skip to content
Urban Web Host

Urban Web Host

Security, in plain terms

You're handing over context about your business, sometimes your codebase, and occasionally credentials. Here's exactly how we handle that.

Authentication

Password-based login with optional multi-factor authentication, and short-lived access tokens with separate refresh tokens.

Role-based access control

Every account has a role — client, engineer, admin, and more — and every API request is checked against that role on the server, not just hidden in the interface.

Credential handoff

We never store your passwords or API keys as plain text. Access is granted through the provider's own invite system where possible, or through a time-boxed, encrypted vault entry that auto-expires and logs every view.

Encryption

Data is encrypted in transit (TLS) and at rest. Secret vault entries use envelope encryption with a managed key.

Audit logging

Every meaningful action — bookings, payments, refunds, credential access, permission changes — is written to an audit log with who, what, and when.

Rate limiting & input validation

API endpoints are rate-limited, especially around authentication and refunds, and all input is validated server-side before it touches the database.

Not just a promise

What you can see and control yourself

  • See every active session on your account, from every device, and log any of them out
  • Turn on two-factor authentication whenever you want — it's opt-in, not forced
  • Sign in with a passwordless email link instead of a password, if you prefer
  • Get an email alert when a security-sensitive change happens on your account
Evaluating this for a procurement or security review? See how team access, billing, and support work for enterprise engagements.

Found a vulnerability? We'd rather hear about it from you first — reach out through Contact and we'll follow up directly.

Have a security questionnaire? Send it our way.

Book a live session and watch a real engineer build it — not just propose it.

Book a Session