Where your words live, and who can reach them.

Blocky runs on a single-tenant virtual server managed with Laravel Forge, in the United Kingdom. Every workspace lives on its own subdomain and every database row is fenced to its workspace; there is no shared "admin" path across tenants.

The marketing site sets no marketing cookies and loads no third-party scripts. Page views are counted in aggregate on our own server.

The database is backed up every night at 02:00 UK time as a password-protected, AES-256 encrypted archive, copied to off-server storage, and older archives are pruned on a schedule. The restore procedure is written down and rehearsed — a backup nobody has restored is a hope, not a backup.

Traffic is TLS end to end. Passwords are hashed with bcrypt. Sign-in links, review invitations and API tokens are stored only as hashes and are single-use or expiring, so a copy of the database does not contain a working link.

Approvals freeze the exact content signed off, with a SHA-256 fingerprint per section and a hash over every approved page version. The sign-off certificate prints them so a record can be verified later.

Mailgun (EU region) delivers transactional email — sign-in links, review requests, notifications. It sees recipient addresses and message content only to deliver them.

Stripe handles card payments. Card details never touch Blocky’s servers.

Sentry receives error reports with personal data stripped, so we can fix faults without reading your content.

Nobody else. No analytics vendors, no advertising networks, no AI training on your projects.

Your team controls who can reach a project. Reviewer seats — your clients — see only the pages they were sent, never internal notes, assignments or stages, and that boundary is enforced in one place in the code and pinned by tests.

Every change that matters — page edits, reorders, approvals, exports, sign-ins — is written to an audit log your workspace admins can read.

Everything you put in comes back out: Markdown and JSON per project, at any time, from the project page or the API. Ask us to delete your workspace and it is removed completely, backups included on their normal rotation.

We will sign a data processing agreement with any customer who needs one. For that, a security questionnaire, or a vulnerability report, write to hello@blockyhq.com — a human answers.