Isolation tiers

Every Wok is its own private setup, isolated from every other team at the database, network, and authorization layers from the moment it is provisioned. This page explains what that boundary covers and what is available to teams who need more.

What "isolation" actually means here

There are two separate questions, and they're easy to confuse:

• Can another team reach your data or your app? This is the one that matters for nearly everyone, and it's answered the same way on every plan: your own database, your own private network, and a server-side authorization check that returns a blank 404 to anyone outside your team. The database and authorization boundaries hold on every request; the host-level network rules are re-checked every fifteen minutes.
• Can the people running the hardware read your app's memory while it runs? Some regulated teams need a guarantee that we can't, not just that we don't. That's what the Confidential tier adds, and it's the only thing that needs special hardware.

Hardware memory encryption protects everyone on a machine from whoever runs that machine. Separation between teams comes from the database, network, and authorization controls below, which apply on every plan.

What every Wok gets

Your Wok runs its own Postgres, its own services, and its own private network. Nothing is co-tenanted at the database or network layer: another team's Wok cannot address your database, reach your services, or see your traffic, and its credentials do not exist in your stack.

On every paid plan, your Woks run on your own private server, so no other team's workloads share your machine. Free Woks run on the shared platform with the same database, network, and authorization isolation.

If you need more separation

Two stronger arrangements exist for teams whose compliance requires them, and both are set up with us rather than chosen at provisioning time:

• Sandboxed runtime — your containers run inside a runtime that sits between your app and the host kernel, narrowing what a hostile workload could reach.
• Confidential compute — hardware that keeps your app's memory encrypted while it runs and can attest which code is running, so TellWang cannot read your running memory. It needs AMD SEV-SNP or Intel TDX hardware, brought online per engagement.

If either is a hard requirement, talk to us before you build.