Fishpond holds a stranger’s client list, and sometimes the tokens for the services that list came from. That makes it a data processor with obligations, not a dashboard. This page says what is actually done, today, and nothing that is only planned.
Every account’s brands live in that account’s own rows, and every read of brand data takes the account id as its first argument. There is no code path to a brand that does not pass through the session or the API key first.
A brand that is not yours is a 404, never a 403. A 403 would confirm the brand exists, which is enough to learn who else uses Fishpond. This is asserted by a test that runs two real servers and, separately, verified over HTTPS against the live deployment: the other account’s brand is never contacted.
Each brand’s records sit in that brand’s own database on its own Worker. A problem with one brand cannot read, or take down, another.
A brand’s API token and every connection credential are encrypted at rest with AES-GCM under a key that lives only in the deployment’s secret store. They are decrypted inside the request that uses them and returned by no endpoint, not even to the account that owns them. Lose one and you re-enter it; there is no route whose job is handing credentials back out.
A brand token never reaches a browser. The dashboard proxies every call server-side.
A key is shown once, at creation, and only its hash is stored. Keys carry scopes (read, write, delete) and can never do more than the person who minted them: demote or remove that person and every key they hold shrinks or dies on the next request. Every non-read call through a key is an audit row with the key as the actor. Calls are counted per account per month and refused at the plan’s limit.
Deletes are soft and restorable, so an agent can use them. Erasure, which a person’s right to be forgotten requires, is a distinct route. Every brand exposes an export, and an account’s settings and audit log export too.
Append-only. The module that writes it exports no update and no delete, and a test fails the build if one appears anywhere in the codebase. Sign-ins and failures, invitations, role changes, brands and connections created or changed, keys minted or revoked, and every write through the screen or the API, with who and when. Fields named like a secret are dropped before a row is written; values shaped like one are redacted.
Cloudflare Workers, D1 and KV, in Cloudflare’s network. The operator is a single person, so there is no on-call rota and no SOC 2 report. If that is the bar you need, Fishpond is not there yet and says so here rather than on a sales call.
The data processing agreement, terms and privacy notice are drafts under review, and are finalised before the first paid subscription. Questions: hello@mynato.app.