Developer platforms & services → start here

Reference guides for the hosting, cloud, and developer services behind custom applications: access, roles, secrets, and ownership.

Time
3 min read
Difficulty
Intermediate
Last updated
Updated
Share
Reference topicHosting topicSecurity topic

Custom applications run on more moving parts than a typical website: a hosting platform, a database, a cache, file storage, an email sender, error tracking, and a pile of API keys holding it all together. This section is our reference for how access, ownership, and secrets work on each of them.

This section is for your developers, not for you

If you are here to give us access to something, you almost certainly want Giving Chykalophia access instead. Start with the access directory (A to Z) and look up your tool by name. The pages below are technical reference material for whoever looks after your servers and code. Nothing here is required reading for a business owner.

If you only read three things

  1. The principles below: the rules that hold across every platform on this list.
  2. Managing environment variables & secrets: where most real incidents start.
  3. Transferring ownership to you: the conversation to have before you need it.

Principles that apply everywhere

The platforms differ; the rules don't.

The account belongs to the business, not an individual. Register on a shared, role-based address rather than one person's inbox. When that person leaves or loses access, everything they own becomes a recovery problem.

Use the least privilege that works. Nearly every platform here offers a read-only or developer-tier role, though on several of them the genuinely restricted tiers only exist on a paid plan. Admin and Owner should be rare and deliberate.

Invite people, don't share logins. A shared password can't be revoked for one person, can't be audited, and breaks two-factor authentication.

Secrets are rotated, not deleted. Removing someone's user account does not invalidate an API key they once created. Offboarding means rotating keys too.

Turn on two-factor authentication everywhere. Especially on the account that owns billing and DNS.

Hosting & deployment

Vercel

Teams, project roles, environment variables, and transferring a project.

Render

Workspace members, services, environment groups, and ownership.

Environment variables & secrets

Where secrets live, how to rotate them, and what never belongs in Git.

Cloud infrastructure

AWS accounts & IAM

Root accounts, IAM users and roles, and the few tasks that still need root.

Amazon S3

Bucket access, public-access blocking, and sharing files safely.

AWS KMS

Encryption keys, key policies, rotation, and the danger of deletion.

Data stores

Managed PostgreSQL

Database roles, connection strings, backups, and credential rotation.

Managed Redis

What Redis is used for, how access works, and why it isn't a database.

Application services

Sentry

Error tracking, organization roles, DSNs, and scrubbing personal data.

SendGrid

Teammates, API key scopes, sender authentication, and deliverability.

ClamAV

Open-source malware scanning for uploaded files, no account required.

SurveyJS licensing

Commercial license keys, seats, and keeping keys out of public code.

Mobile & tooling

Expo & EAS

Organization roles, build credentials, and app store ownership.

Amazon Q Developer

AI code review in the developer's editor, and what it can see.

GitHub access

Repository access for source code, including organization-owned repositories.

Was this page helpful?

Go deeper on chykalophia.com

Talk it through

Want a second pair of eyes on this?

Book a free discovery call, up to an hour. Bring the question you're stuck on and we'll tell you honestly what we'd do.

Book a free callSee how we work

Already a client? Email support@chykalophia.com.

Last updated