Explanation · the company trust boundary

A URL does not grant access.

Up verifies a company session before returning a site or any of its capabilities.

One company boundary

Cloudflare Access authenticates employees. Up converts that identity into a scoped sibling-domain session. Missing identity returns no uploaded content.

The hostname selects one site

Database collections, uploaded files, AI requests, and realtime channels are resolved from the current site hostname. Browser code cannot supply another site’s resource ID.

Credentials stay on the server

The browser receives a fixed same-origin API. R2, Durable Object, and Workers AI credentials never enter site code.

A deployment appears all at once

Files remain pending in private R2 until every manifest digest passes verification. Activation changes one pointer, so visitors receive either the previous complete version or the next one.