01
Artifacts are verified end to end
The CLI creates a deterministic archive, hashes it with SHA-256, and sends that manifest with the deployment. The runtime verifies the stored object before extracting or starting it.
Security at BlackSails
Small attack surface. Explicit boundaries.
BlackSails narrows the supported runtime and deployment contract so security decisions can be enforced consistently from the local build to the public edge.
Defense in the workflow
Security is part of the release protocol.
02
Applications are isolated by infrastructure
Every application environment receives a separate runtime project. Provider projects cannot be reused by a different BlackSails mapping, including two applications owned by the same workspace.
03
Origins stay behind a controlled edge
Public application traffic resolves through the BlackSails edge. Internal origins require a platform token, while customer responses are stripped of provider and internal routing headers.
04
Secrets stay outside the release
Environment values are submitted through a hidden prompt or standard input, stored separately from the artifact, and injected only when the managed runtime starts the application.
05
Customer-facing output is deliberately narrow
Public APIs and logs avoid returning internal project IDs, service IDs, provider hostnames, raw provider errors, storage URLs, or platform environment variables.
06
Failure paths preserve safe state
Health checks gate production promotion, release work is leased to prevent duplicate execution, retry budgets are bounded, and recovery uses retained healthy artifacts when billing permits it.
Shared responsibility
A clear line between your app and the platform.
BlackSails operates the deployment path and runtime boundary. You remain responsible for the application code and the data it chooses to handle.
BlackSails
Artifact transfer and verification; runtime provisioning; origin access; platform credentials; health-gated promotion; infrastructure isolation.
You
Application code and dependencies; authentication inside the app; authorization; data handling; application secrets; health endpoint behavior.
Current scope
What this page does—and does not—claim.
This is a technical overview of controls implemented in the current BlackSails product. It is not a claim of SOC 2, ISO 27001, HIPAA, PCI, or any other third-party certification.
The platform currently supports managed ASP.NET Core web applications only. It rejects Dockerfiles, arbitrary images, non-web projects, and oversized compressed artifacts to keep the runtime contract bounded.
For the precise supported project shape and secret-handling commands, see the developer documentation.
A smaller cloud surface for your .NET service.
Bring an ASP.NET Core project. BlackSails handles the release, runtime, and production URL.