How Statpio is built
Built to keep your websites safe, fast and online
What happens behind the scenes when someone visits your website, sends a form or when you publish a change. In plain words, and without the internal details that would only help an attacker.
A global network
Websites are served from Cloudflare's network, in hundreds of cities.
Versioned publishes
Every publish is a new version, and recent ones are a click away.
Protected forms
Bot checks, honeypots and rate limits on every form.
Cookie-free analytics
No cookies, and IP addresses are never stored.
A visit
What happens when someone opens your website
From the visitor's browser to your page, your forms and your analytics.
A visitor opens your address
On your own domain or a free onstatpio.com address, always over HTTPS.
The nearest location answers
Cloudflare's closest data centre answers, from its cache when it can, so pages load quickly wherever the visitor is.
Your live version is served
The cache follows your live version, so a new publish or a rollback shows straight away.
Forms and visits are recorded
Form sends are checked for spam and queued for your inbox; visits are counted without cookies.
A publish
What happens when you publish
Your live website never changes halfway: a new version goes live in one step, or not at all.
You publish
Drag in a ZIP, push to GitHub, use the command line or ask your AI assistant.
Files are checked
Archives are unpacked safely, hidden files such as .env are left out, and content is screened for abuse.
A new version is stored
Your files are saved as a separate version. Nothing changes on your live website yet.
Live in one step
Once every file is in place, the new version replaces the old one all at once.
Undo any time
Changed your mind? Put an earlier version back in one click.
Security
Safe by default
Protection that is on from the start, for your account, your websites, your forms and your payments.
Static by design
Statpio hosts static websites, so there is no server code of yours to break into: no PHP, no database and no plugins to keep patched.
Accounts
Passwords are salted and hashed, never stored readable. Sessions are short and renewed automatically, and if an old sign-in token is used again, every session is signed out.
Sign-in protection
Bot checks and rate limits on sign-in, sign-up and password reset. Email links work once and expire, and sign-in and password reset don't reveal whether an account exists.
Websites kept apart
Websites are served on their own domain, separate from your dashboard, from the files you published, with security headers on every response.
Safe uploads
Archives are unpacked with protection against oversized and booby-trapped files, and hidden files such as .env are never published.
Protected forms
Every form has a bot check, a hidden honeypot, rate limits and a list of file types that are always refused.
Keys and connections
API keys and AI app tokens are stored hashed, and a Google Search Console connection is stored encrypted. AI apps connect through standard OAuth, with PKCE for apps that can't keep a secret, only after you approve them, and you can disconnect them from your account.
GitHub without stored secrets
GitHub deploys sign in with short-lived tokens tied to your repository and branch, and GitHub's messages to Statpio are signature-checked.
Payments
Checkout is hosted by our payment provider, so card details never reach Statpio. Payment notifications are signed and applied only once.
Domains stay yours
A domain that is already on Statpio can only be moved to another account with proof of ownership in its DNS.
Abuse screening
Automated checks look for phishing, scams and malware on published websites, and anything flagged goes to a person for review.
Reliability
Built to stay online
Publishing, forms and plan changes are designed so that one problem doesn't turn into a broken website.
Publishes that go live in one step
Every publish is stored as its own version and goes live in a single step, and an older publish can never overwrite a newer one.
One-click rollback
Put an earlier version back in one click, from the dashboard or from your AI assistant.
A cache that follows your live version
The cache is tied to your live version, so visitors don't get yesterday's pages after you publish or roll back.
Leads are queued
Form sends go through a queue, with retries and a fallback, so a brief hiccup doesn't lose a lead.
Publishing takes turns
Publishes run through a queue too, so a rush of them is handled in order instead of all at once.
Steady through brief problems
Websites keep being served from their last known settings through a brief database problem, and pages are served as they are if anything extra can't be added.
No surprises when a plan ends
You get notice before anything is paused, and nothing is paused because of an error on our side. Paused websites and your portal come back when you upgrade; removed custom domains are added again from the dashboard.
Scale and speed
Fast for every visitor
Pages come from close to your visitors, and growth needs nothing from you.
Cloudflare's global network
Websites are served from Cloudflare's network, which spans hundreds of cities in more than 100 countries, so visitors are answered from nearby.
Caching that stays fresh
Files that never change are cached for a long time, and repeat visits only download what changed. A new publish shows straight away.
Large files handled well
Uploads stream straight to storage, and videos play while they load instead of downloading first.
Nothing to size or manage
There are no servers for you to choose, resize or keep running: the same setup serves your first website and your hundredth.
Network size: Cloudflare, the Cloudflare global network, as of October 2026.
Privacy and your data
Your data, handled with care
We collect what the product needs to work, keep it only as long as it is useful, and let you take it with you or delete it.
Cookie-free analytics
Analytics sets no cookies. Visitor IDs change every day, IP addresses are never stored, and bots are filtered out.
Form answers
We keep what a visitor sends you. Their IP address isn't stored with it; a short-lived fingerprint used against spam is erased after 7 days.
Encrypted storage
Your websites, files and account data are kept in Cloudflare's database and file storage, which encrypt everything they store with AES-256 and use TLS in transit.
Take your leads with you
Export your leads and waitlist signups as CSV whenever you like.
Delete when you want
Delete a lead and its files go with it. Delete your account and billing is cancelled, your domains are released and your websites, files and leads are removed.
Encryption: Cloudflare's data security pages for its database and its file storage, as of October 2026.
How we work
Careful changes, checked before they ship
The way we build matters as much as what we build.
Hundreds of automated tests
Tests cover sign-in, publishing, billing, forms, analytics, the blog and the client portal, and run before changes go out.
Checked before release
Code is type-checked and linted before release, and nothing goes out without a clean production build.
Small, careful releases
Changes ship in small steps, so each one is easy to check and, if needed, easy to undo.
Security reviews
Recurring internal reviews look for security problems in the code, and what they find gets fixed.
Found a security problem?
Email support@statpio.com with what you found and the steps to see it. Please give us the chance to fix it before you share it publicly.
See what it can do for your websites
Hosting, forms, analytics, a blog and a client portal, with the plan each part comes with.