Security & data
What actually happens to your data.
Written for the person who has to decide whether to put a production database here — including the parts that argue against it.
Where your data physically sits
Your instance runs on one machine in one region that you chose, and its SQLite database lives on that machine's disk. Pro subscribers pick from 10 regions at checkout; Starter can pick a shared-pool location; Free is placed automatically. A compute's region is fixed once provisioned — there is no silent migration to somewhere else.
Isolation between instances
Every PocketBase instance, backend and frontend runs in its own rootless Podman container under its own dedicated system user, managed by Quadlet and user-level systemd. Instances on the same compute do not share a filesystem, a process namespace, or a database file.
Transport security
Every instance is served over HTTPS by Caddy, which obtains and renews certificates automatically. There is no plaintext listener to opt into by accident.
Secrets
Environment variables are encrypted at rest with a per-target derived key and are never returned in plaintext by any listing API. The server agent injects them into the container at deploy time.
Payment details
Card numbers never reach our servers. Checkout and the billing portal are hosted by Stripe; we store a Stripe customer id and a subscription id, and nothing else about your payment method.
Backups and getting your data out
PocketBase's own admin has Settings → Backups, which produces a zip of the entire pb_data directory — schema, records and uploaded files — and restores one. It is the upstream feature, not an export format of ours, and it works in both directions: the same zip restores onto a PocketBase you host yourself. `pb settings backup download` fetches the same file from the terminal.
Closing your account
Deleting your account is self-service from the portal. It cancels your subscription in the same step, so the billing relationship ends when the account does rather than by emailing someone.
What we have not done
There is no SOC 2 report, no ISO 27001 certificate, and no signed BAA. If your procurement process requires one of those, this platform does not clear that bar yet, and we would rather say so here than in a sales call.
Subprocessors
The complete list of third parties that necessarily touch some part of the service. If it is not here, it does not see your data.
| Provider | Purpose | Regions |
|---|---|---|
| OVHcloud | Dedicated Pro computes (10 regions) | EU, North America, Asia-Pacific |
| Hetzner | Shared server pool for Free and Starter | Germany, Finland, United States, Singapore |
| Cloudflare | DNS for *.pocketbasecloud.com | Global |
| Stripe | Payments, subscriptions and the billing portal | Global |
Reporting a vulnerability
Email [email protected] with enough detail to reproduce the issue. You will get a human reply — the aim is within two business days, and if it takes longer than that you will hear why rather than nothing.
Please do not test against other people's instances, and please give us a chance to ship a fix before publishing. There is no bug bounty programme; there is credit in the changelog if you want it.
The strongest guarantee here is that you can leave
Every promise on this page is a promise about how carefully we hold something. The one that does not depend on trusting us is portability: your data is a stock PocketBase pb_data directory, downloadable as a zip from your own instance's admin at any time, restorable onto any PocketBase anywhere. Read the docs before you sign up, not after.