What is LockFlare

LockFlare keeps your source code encrypted everywhere it rests — on disk, in transit, and in storage — and decrypts it only into the volatile memory of a server you control. Nothing readable is ever written to that machine’s filesystem.

It is software-only. There is no special hardware, no secure enclave chip, no cloud provider to trust. You install a single binary on an ordinary Linux server — your own, or your client’s — and it serves your application exactly as it would have run natively.

The problem it solves

When you deploy software to infrastructure you do not own, you hand over your source. A client with root on their own server can read every file you put there. So can anyone who compromises it, anyone who takes a snapshot of the disk, and anyone who walks out with a backup.

The usual answers are all partial. Obfuscation slows a reader down for an afternoon. Compiling to bytecode moves the problem rather than solving it. Containers isolate processes from each other, not from the host. And a hosted platform means the code sits on someone else’s machine under someone else’s terms.

LockFlare’s position is narrow and specific: the plaintext of your application exists only inside a running process. Stop the process and there is nothing on that machine to read.

What that looks like in practice

Your code is encrypted with AES-256-GCM on your machine, before it leaves it.
It is stored as ciphertext and transmitted as ciphertext.
The Engine on your server decrypts it into RAM and executes it there.
No plaintext file is written at any point — not to a temp directory, not to a cache, not on restart.
Your application behaves normally: same framework, same routes, same dependencies, same performance profile.

What LockFlare is not

It is not a build system. LockFlare serves the build you give it — it does not compile, transpile or bundle your code. If your project needs a build step, you run it as you always have, and LockFlare deploys the output.

It is not a hosting provider. The servers are yours. LockFlare never runs your application on infrastructure it controls, which is the whole point — your deployment target can be a client’s datacentre, an air-gapped network, or a rack in your own office.

And it is not a DRM wrapper. There is no phone-home licence check that breaks your app when a network blips. The Engine holds a licence bound to its server, but your application’s availability does not depend on reaching us.

Who it is for

Software vendors

You ship an application that runs on a customer’s infrastructure and you would rather not ship the source with it. On-premise delivery without handing over the product.

Regulated deployments

Data residency or sovereignty rules put the servers somewhere specific. LockFlare lets the code run there without being readable there.

Agencies and contractors

You build and host for clients who own their infrastructure. The client gets a running system; you keep the source you wrote.

Multi-tenant operators

One fleet, many customers, per-domain isolation — and every tenant’s code encrypted separately from every other.

Not sure whether it fits? The free tier is genuinely free — one server, eight cores, no expiry and no card. It is the same runtime and the same encryption as every paid plan. See Editions.