Secure by design, verifiable by anyone
Every update is signed with your key, served from a CDN and verified on the device. No server of ours is on the path, and anyone can check.
The device path is public. Here is the whole of it
A device fetches its update before any account exists on it, so what a device reads is public by design. Here is the complete inventory.
On files.hotcodepush.com a device reads plain files: the channel index, the bundle manifest and your web build’s files. Anyone holding the app id and a channel id can read them, and both ship inside your binary, as in every over-the-air (OTA) update product. Four controls bound it: no channel is discoverable by default, a channel id is an unguessable random id, attribute values appear only as hashes, and with code signing a device applies nothing you did not sign.
Diagram, two panels. Public by design: the channel index, the bundle manifest and the files on files.hotcodepush.com, readable by anyone holding the ids in your binary. Behind a credential: the device registry, the audit log and usage on api.hotcodepush.com, a session or an API token
Six facts, each with its page
What is signed, what is verified, where data lives and for how long. The docs page behind each card says it in full.
Signed with your key
Free on every plan. The CLI makes the key pair and signs at upload; the private key never reaches us, and a registered key refuses unsigned releases.
Set up code signingVerified on the device
Every file is checked on the device against what you released, never against what the server claims. The index only moves forward, and every transfer is encrypted.
How verification worksFail-open, by design
Update checks are static files on a CDN, no server in the path. Our outage breaks no installed app: devices keep their current update and wait for the next.
How an update is servedAnonymous device data
A device sends an anonymous install id, the versions it runs and each update’s outcome. No vendor or ad id, and nothing on how a person uses your app.
Read the privacy pageStored in the EU
The database, the bundles and the encrypted backups all stay in the EU. Old bundles expire on a set schedule; the live update is never deleted.
Read the privacy pageThe audit log
Written in the same transaction as the change: who, with which credential, from where. Every plan writes it; paid plans read it in the console and export CSV.
Read the audit log docs
Report a vulnerability
Security reports are welcome and taken seriously. There is no guaranteed bug bounty, and genuinely impactful reports may be rewarded at our discretion. Write to security@hotcodepush.com or use GitHub’s private vulnerability reporting on the affected repository; the security policy has the details. The machine-readable version is security.txt.
What is not encrypted, and why
Bundles are not encrypted. A bundle is exactly as confidential as the app binary it belongs to: the key would ship inside your app, extractable by anyone who downloads it from a store. Integrity rests on content hashes, a monotonic index and TLS; authenticity is your signing key, which you hold and we never see. A device whose app trusts your key applies nothing you did not sign.
When we are down
Update delivery and the control plane are two surfaces, measured separately. The device path has no server and no database in it, so published updates keep arriving whatever happens to our control plane, and in an outage of either surface devices keep running their current update. Nothing a device reads needs a credential; the console and the API do, and paid plans add OIDC SSO, enforced two-factor authentication and IP and country allowlists.
Compliance
SOC 2 and ISO 27001, audited every year and covering HotCodePush. The reports and policies are on the trust center, and the audit report comes with the Enterprise conversation. The data processing agreement and the subprocessor list are on the legal page.
Verify it yourself: how an update reaches a device.
Free for 1,000 MAU. No credit card.
Questions? Join our Discord or contact us.