Account access
Verified email, HTTP-only session cookies, password controls, and server-side authorization protect publisher actions.
Private storage. Controlled delivery.
DistKit keeps production IPA objects private and applies authorization or share-link policy before serving a manifest or file. Security claims on this page describe implemented controls, not certifications.
Publisher or tester
Worker policy check
Private R2 object
Controls mapped to the action they protect.
The security model follows the account, record, object, link, and device data path.
Tenant records
Production data uses Supabase Postgres with row-level security; service credentials remain server-side.
IPA delivery
Objects are private in Cloudflare R2 and are served through Worker routes after account or share-link policy checks.
Public links
Password, expiry, manifest-request limit, enabled state, App status, and Release status are evaluated before delivery.
Device data
The explicit device flow returns the UDID, hardware model identifier, and iOS version. It does not enroll MDM, and its session expires after about 15 minutes.
Abuse response
Reports can be reviewed, links or Apps can be restricted, and moderation actions are recorded for investigation.
Security boundaries stay visible.
Accurate limits are part of the product contract.
DistKit does
Parse metadata and provisioning information, enforce its own access policy, and keep IPA delivery behind controlled routes.
DistKit does not
Re-sign the IPA, bypass Apple policy, guarantee device eligibility, confirm completed installation, or claim certifications it has not earned.
Publisher owns
Certificates, profiles, entitlements, authorized Enterprise use, device registration, export settings, and tester authorization.
Policies and operational access
Review the public policies or contact support before distributing sensitive builds.
Review the package before you publish.
Start with an already-signed IPA and keep the Release private until its report and link policy are ready.