Enforced by the database, not by the interface
The separation between your sites and everyone else’s is a policy on the table itself, checked on every read and write.
Last updated 22 August 2026
Where your data sits
A site you have not saved lives only in your own browser. A site you have saved is one JSON document in a Postgres database, encrypted in transit over HTTPS and at rest by the database provider.
The editor itself is static files. There is no application server of ours executing your content, which removes a whole class of problem before it starts.
How accounts are kept apart
Separation between accounts is enforced by the database, not by our application code. Every row carries an owner, and a policy on the table compares that owner to the signed-in user on every single read and write. A query that asks for somebody else's site returns nothing — not because the interface hides it, but because the database refuses.
This matters more than it sounds. The key the browser holds is public by design and identifies the project, not a person; on its own it can read nothing at all.
Passwords and sessions
Passwords are hashed by our authentication provider and never reach our own storage in a readable form. We cannot tell you your password because we do not have it.
Sessions are short-lived tokens that refresh in the background and are dropped when you sign out. Signing out on one device does not silently leave another signed in forever.
Published sites
Published output is HTML and CSS with no runtime, no framework and no script from us. HTTPS is issued automatically. Because there is nothing executing, a published BLOKZA site has no dependency to patch and nothing to compromise on the server side.
Anything you paste into a custom code block is yours and runs as you wrote it. Content arriving from elsewhere is sanitised against a fixed allow-list before it is rendered, so a pasted fragment cannot introduce a script into your page.
What we deliberately don't do
- No analytics, session recording or advertising script on this site.
- No third-party trackers injected into the sites you publish.
- No use of your content to train models.
- No admin key in the front end. The browser only ever holds the public key.
Reporting something
If you find a vulnerability, send it to security@blokza.com with enough detail to reproduce it. We will confirm receipt, keep you posted while we fix it, and credit you if you want the credit. Please give us a reasonable window before publishing, and please do not test against other people's sites.