---
layout: article
title: Security
description: Learn how Appwrite keeps your project, users, and data secure through security measures and compliance.
---

Appwrite helps you build secure apps by applying various security and compliance measures.
Appwrite is compliant with [GDPR](/docs/advanced/security/gdpr), [CCPA](/docs/advanced/security/ccpa),
[HIPAA](/docs/advanced/security/hipaa), and [SOC 2](/docs/advanced/security/soc2).

Appwrite also employs [enhanced password protection and encryption](/docs/products/auth/security), [rate limits](/docs/advanced/security/abuse-protection),
[robust permission systems](/docs/advanced/security/permissions), and [HTTPS/TLS](/docs/advanced/security/tls) to protect you and your users' data.

# Compliance

The safeguarding of your and your users' data is taken seriously at Appwrite.
Appwrite works to achieve compliance with a variety of standards to protect sensitive data, as well as maintain trust and credibility.

- [GDPR](/docs/advanced/security/gdpr): Appwrite is GDPR compliant. Learn about our measures, privacy policy, and find our data processing agreement.

- [PCI](/docs/advanced/security/pci): Appwrite uses Stripe to handle payment and payment information securely. Learn about Appwrite's PCI compliance.

- [SOC 2](/docs/advanced/security/soc2): Appwrite is SOC2 Type I compliant. Learn about Appwrite's measures to meet SOC 2 standards.

- [HIPAA](/docs/advanced/security/hipaa): Appwrite is HIPAA compliant. Learn about Appwrite's measures to protect personal health information.

- [CCPA](/docs/advanced/security/ccpa): Appwrite is CCPA compliant. Learn about our measures to protect consumer privacy under the California Consumer Privacy Act.

# Measures

Appwrite employs a variety of measures to help you build secure applications, faster.
Learn about the different ways Appwrite protects you and your users' data and privacy.

- [Authentication](/docs/products/auth/security): Secure authentication methods to protect your users and promote better passwords.

- [Encryption](/docs/advanced/security/encryption): Appwrite encrypts sensitive data and files in Appwrite Databases and Storage.

- [Multi-factor authentication](/docs/advanced/security/mfa): Add a second layer of protection by requiring users to verify their identity with multiple factors.

- [HTTPS](/docs/advanced/security/https): Appwrite Cloud enforces HTTPS on all endpoints to prevent on-path attacks like packet sniffing.

- [TLS](/docs/advanced/security/tls): Appwrite assigns TLS certificates on all Appwrite and user provided domains connected to Appwrite.

- [Backups](/docs/advanced/security/backups): Appwrite Cloud uses regular backups to prevent data loss and improve resiliency.

- [Penetration tests](/docs/advanced/security/penetration-tests): Appwrite employs regular third-party penetration tests to find vulnerabilities.

- [Audit logs](/docs/advanced/security/audit-logs): Appwrite provides detailed audit logs for each product to track and discover suspicious activity.

- [Abuse protection](/docs/advanced/security/abuse-protection): Appwrite protects against common abuse methods like DoS and brute-force attacks.

# Access control

Appwrite is secure by default and provides tools for you to manage
access control and prevent abuse.

- [Permissions](/docs/advanced/security/permissions): Control which users can access which resources.

- [Roles](/docs/advanced/security/roles): Learn about Console organization member roles and the access each one grants.

- [Rate limits](/docs/advanced/security/rate-limits): Appwrite has rate limits on some endpoints to prevent abuse.

- [API keys](/docs/partners/project/api-keys): Create and manage API keys used by Server SDKs.

- [Dev keys](/docs/advanced/security/dev-keys): Create and manage dev keys used by Client SDKs in dev environments.

# Configuration

Pass constants and secrets to your Appwrite resources.

- [Environment variables](/docs/partners/project/environment-variables): Use project, function, and site environment variables to pass constants and secrets to your Functions and Sites.

# Reporting vulnerabilities
If you discover security vulnerabilities, please contact us at security@appwrite.io.
Please avoid **posting a public issue** on GitHub or elsewhere online to prevent malicious actors
from abusing the vulnerabilities before the Appwrite team has chance to patch the issue.