Security and your data
Where frascati runs and keeps your data, how your account and your payments are protected, and where to turn when something is wrong.
Where it runs
frascati.app and the sites published with it are delivered by Vercel. The app’s server functions run in Vercel’s region in Frankfurt, Germany, next to the database.
Your account, your projects with their chat and versions, your published sites, and the form messages, bookings, orders and table entries of your sites are stored in a Postgres database run by Neon in Frankfurt, Germany.
Encrypted connections
frascati.app answers only over HTTPS. A request over plain HTTP is sent on to HTTPS, and browsers are told to use HTTPS only for the next two years (HSTS).
Your password and your sessions
Your password is stored only as a bcrypt hash (cost 12), never in a form that could be read back. If you sign in with Google or GitHub, frascati keeps no password for you.
Signing in sets one session cookie. Its content is encrypted, scripts on the page cannot read it, it travels only over HTTPS, and it ends when you sign out or after 30 days without use.
Deleting your account in Settings cancels your plan and removes your account and your projects from the database.
Payments
You pay for your plan on Stripe’s checkout page. Your card number goes to Stripe and never reaches frascati.
On your sites, buyers pay on Stripe’s checkout page, into your own Stripe account. The Stripe key you connect is encrypted with AES-256-GCM, stays on our servers and is never shown in the browser or given to the AI.
Your sites
Previews in the editor and the sites at frascati.app/p/ run in sandboxed frames: the code of a site never runs as frascati.app, so it cannot reach your account.
Who processes data for frascati
Hosting, the database, emails, the AI and error reports are run by providers that process data for frascati. Who they are, where they are and what they receive is in the privacy policy and the data processing agreement.
Report a security issue
Found a weakness in frascati? Write to support@frascati.app or use the contact form with the subject Security. Please describe what you found and how to reproduce it.
Report abuse
A site made with frascati used for phishing, a fake shop or content that breaks the law? Send us its address and what is wrong, with the contact form or at support@frascati.app. What sites made with frascati may not do is in section 10 of the Terms.