Every business in one place. So it had better be careful.
Fleet can back up, move and restore everything you run. This page says how it decides who may do that, what it writes down, and what it cannot protect you from.
Your password is not enough on its own.
Signing in takes a code from an authenticator app on your phone, with recovery codes for the day you lose it.
Being signed in is still not enough for the risky buttons. These seven ask for a fresh code every time:
- Restoring a backup
- Deleting a mailbox
- Stopping or starting a site
- Deleting a business
- Opening a terminal
- Connecting a repository
- Reading the backup key
Fleet asks for jobs. It does not run commands.
Your servers only call out
The one line you paste on a server makes it call Fleet. It opens nothing on your server to the internet, so there is no new door for anybody to knock on.
A fixed list of jobs, not commands
Fleet asks your servers for named jobs: back this up, start this site, restore this. Outside a terminal you open yourself, that list is all a server will do for it.
A terminal only when you open one
If you need a command line, you open a window for one server, with a code from your authenticator app. It closes itself. Every command in it is written down with what it answered.
Servers talk privately
Your servers talk to each other over a private, encrypted network, whichever companies you rent them from.
Everything is written down, including what was refused.
Who did what, when, and what it answered. A list of every sign-in. An alert when somebody does one of the risky things.
The refusals are in the log too, because an attempt is worth knowing about.
A backup that lives beside the original is not a backup.
Every night by default, databases included, with a second copy on another of your servers.
A second copy the first server cannot reach
Another of your servers fetches its copy. The first server holds no key to it, so if a provider loses a server, or somebody breaks into one, the copy on the other survives.
Locked, if you want
Backups can be encrypted with AES-256. It is only switched on after you confirm you have saved the key, so nobody locks themselves out by accident.
Checked, not assumed
Archives are checked every 14 days. Each backup server shows exactly which backups it holds, by business, and when each is kept until. Files with no record are shown to you, never deleted.
Restoring asks first
A restore puts a backup back on the right machine, checks it first, and needs a code from your authenticator app. Fleet backs itself up every hour too.
Anything you let in gets one business, not all of them.
Assistants are optional. When you use one, it asks, you approve with a code, and it can only reach what you said.
You, to your assistant
Add a Christmas pre-order page to the bakery site.
Your assistant
I have asked Fleet to let me build Riverside Bakery. Approve it with this code:
4 8 1 7
A chat wants to build Riverside BakeryOnly this business. Ends within eight hours. Code 4817.
AllowAn assistant gets one business
An assistant like Claude only gets in after you type its four-digit code in Fleet, and only to the one business you picked, at the level you picked: look, build, or everything. It cannot see the others.
And it stops the same day
An unanswered request expires in 10 minutes. Access ends within eight hours. One button takes every assistant out at once, and everything it did is in your log.
Keys for automation are narrow
A key for a script or another tool is limited to one business or one server, with only the permissions you tick. It can expire, and you can revoke it.
Secrets are sealed
The settings an app starts with, like keys and passwords, are stored sealed and never shown again. Database and mailbox passwords are shown once.
Nobody else’s Fleet shares yours.
Each customer’s Fleet runs separately, with its own database and its own encryption key. There is no shared customer database for one customer’s trouble to spread through.
What this does not protect against.
Better you read it here than find it out later.
Somebody else with full control of a server
If you give another person root on one of your servers, they can do anything on that server, whatever Fleet does. What they do there outside Fleet is not in Fleet’s log either.
A provider having a bad day
When a provider has an outage, the servers you rent there are affected, and no control panel can keep them running. That is why the second backup copy lives on another server, and why it is worth putting it with another provider.
Whether email reaches the inbox
Fleet writes the records that receiving mail servers check. Whether a message lands in the inbox is decided by whoever receives it, and nobody can honestly guarantee that. We will not.
A hole in the site itself
Fleet runs what you put on it. An out-of-date plugin or a bug in an app is still a way in. The nightly backups are what get you back from one.
Your own sign-in, handed over
Somebody with your password and your authenticator app is, as far as Fleet can tell, you. Keep your recovery codes somewhere safe and apart from your phone.
If you stop using Fleet, your sites keep running.
Your servers are rented on your own accounts with your providers. Your websites, databases and email run on them, not on us.
You would lose the watching, the nightly backups and the buttons. Not the businesses.
Something here we have not answered?
Ask before you bring anything in, not after. A person answers.