Trust and security

Security is part of the product, not an afterthought.

SaveOn is designed around protected accounts, controlled credentials, separated administrator access, and clear operational communication.

Create your workspace Talk to the team

Account and session protection

An infrastructure workspace contains valuable data and powerful actions. Account verification, bearer-token authentication, separated administrator sessions, and careful route protection reduce the chance that an ordinary customer session is treated as an administrative one.

• Verify the account before sensitive provisioning actions

• Keep administrator and customer navigation separate

• Use short-lived operational access where possible

• Revoke sessions and keys after suspected compromise

Credentials and connection details

Connection details are sensitive. They should be revealed only to an authenticated owner after an explicit action, never placed in public pages, and never included in ordinary support messages. API keys should be stored in server-side environment variables and rotated when a team member or deployment changes.

• Never commit API keys or connection strings

• Use one integration key per environment

• Revoke exposed keys immediately

• Avoid printing credentials in logs

Payments and wallet records

Deposit events and wallet credits need an auditable lifecycle. An instant deposit is credited only after its verified success event. A manual digital-bank transfer remains pending until its review process confirms it. Failed or malformed events do not credit the wallet.

• Visible transaction status

• Idempotent success settlement

• No credit for failed or pending instant payments

• Separate manual-transfer review state

Operational communication

A good security experience includes honest status. The workspace can show endpoint state, synchronization time, reservation status, and provider-returned health signals when available. When a measurement is not available, it should be identified as unavailable rather than replaced with a made-up status.

Frequently asked questions

Should I send my connection string to support?

No. Send the workspace name, approximate time, and an error message without passwords, connection strings, or API keys.

What happens if an API key is exposed?

Revoke it immediately, create a replacement key, update the affected deployment, and review logs for unexpected activity.

Does the public website show internal provider details?

No. Public and customer-facing copy uses neutral infrastructure language and does not expose internal credentials or account identifiers.

Continue exploring SaveOn

Choose the next resource for your project, from practical documentation to pricing, security, and support.

Read privacy policy Read acceptable use Open documentation