How we keep your data safe.
No buzzwords, no fine print. Here's exactly what we do to protect your sites and your data.
Ask us about securityEU
hosting, backups included
SSL
automatic on every domain
Daily
backups with self-serve restore
GDPR
aligned, export or delete anytime
Six pillars, no shortcuts.
Isolation, encryption, automatic SSL, EU hosting, daily backups, and openness when things go wrong. Every plan gets all six, including Free.
Strict isolation between sites
Every site is isolated from every other site. Your pages, media, and settings are yours alone. No site can read another site's data.
Encryption everywhere
Your data is encrypted in transit and at rest. Connections to the studio and your published sites are always encrypted.
Automatic SSL
Every domain gets an SSL certificate automatically, including your own custom domains. Set up once, renewed forever, no extra cost.
Hosted in the EU
Your sites and your data live on servers in the European Union. Backups stay in the EU too.
Daily backups with restore
Every site is backed up automatically every day. If something goes wrong, you can restore from a backup yourself.
Open about incidents
We publish current status and incident updates on our status page. If something affects you, you hear it from us first.
What you can count on
No certification badges, no vague promises. Just the things we actually do, stated plainly.
GDPR-aligned · EU hosting · Daily backups · Auto SSL · Built-in cookie banner
GDPR-aligned
We follow GDPR principles. Export your data or delete it anytime, straight from your account. No support ticket needed.
Cookie banner built in
Every site can ship with a compliant cookie banner out of the box. Configure it in settings, no third-party scripts required.
Your content is yours
You keep full ownership of everything you create. Export pages, media, and collections anytime.
EU hosting
All data is hosted and backed up inside the European Union.
Responsible disclosure
Found something? Email security@dragdrop.studio and we'll take it seriously, respond quickly, and credit you if you want.
How we operate
Process is what keeps the pillars standing. These are the habits we hold ourselves to, every day.
Code reviews
Every change is reviewed by a second engineer before it ships. Security-sensitive changes get extra scrutiny.
Dependency updates
Automated scanning flags vulnerable dependencies, and we patch promptly. Critical issues jump the queue.
No secrets in code
Credentials live in a managed secret store, never in the codebase. Automated scanning backs that up.
Least privilege
Production access is limited to the few people who need it, protected by two-factor authentication, and logged.
Backups we trust
Daily automatic backups for every site, and we regularly test that restores actually work.
Vendor review
Every third-party service we rely on is reviewed before we use it. Our main sub-processors are named in our privacy policy.
Your data lives in the EU
Sites, media, and backups are all hosted inside the European Union. And your content stays yours: export it anytime.
Sites
Hosted in the EU
EU regionBackups
Stored in the EU too
DailyExports
Yours, anytime
Built inResponsible disclosure
Found a security issue? Email security@dragdrop.studio with details. We read every report.
We respond within one business day, prioritize critical issues immediately, and credit reporters who want it.
security@dragdrop.studio · we credit reporters
Questions about security?
Ask us anything: how your data is stored, how backups work, how to export everything. We answer within one business day.
Free plan at launch · Early access invites · One click unsubscribe