> ## Documentation Index
> Fetch the complete documentation index at: https://wisty.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Where apps run

> The boundaries around live previews and published apps.

Your preview runs in an isolated sandbox while you work. Publishing creates a saved build that viewers can open without running your editing session.

This page provides background for security reviews. For the publishing steps, see [Publish and update an app](/docs/publishing/publish).

<div className="docs-diagram">
  ```mermaid actions={false} theme={null}
  ---
  config:
    theme: base
    themeVariables:
      fontFamily: inherit
      fontSize: 15px
      lineColor: "#8C817A"
      edgeLabelBackground: "#FFFFFF"
    flowchart:
      nodeSpacing: 24
      rankSpacing: 32
      padding: 12
      curve: basis
  ---
  flowchart TB
      accTitle: The boundary around generated app code
      accDescr: Generated app code runs in an isolated frame. It can send Salesforce requests to Wisty only. Requests to the public internet are blocked. Record writes go through the trusted Wisty host page and its approval controls. Wisty holds the encrypted Salesforce credentials and calls Salesforce as the signed-in user.

      F("Isolated frame<br/>Generated app code"):::app
      X["Public internet"]:::blocked
      H["Wisty host page<br/>Approval controls"]:::process
      B["Wisty backend<br/>Encrypted Salesforce credentials"]:::input
      S[("Salesforce")]:::data

      F -.->|Blocked| X
      F -->|Salesforce reads| B
      F -->|Record writes| H
      H --> B
      B -->|"As the signed-in user"| S

      classDef input fill:#F5F3F0,stroke:#D6CFC8,color:#51463F,stroke-width:1px;
      classDef process fill:#FFF1E8,stroke:#D94400,color:#8A2C0D,stroke-width:1.5px;
      classDef app fill:#FFF1E8,stroke:#D94400,color:#8A2C0D,stroke-width:2px;
      classDef data fill:#EFF6F1,stroke:#8AA995,color:#315640,stroke-width:1px;
      classDef blocked fill:#FFFFFF,stroke:#B9ADA3,color:#8C817A,stroke-width:1px,stroke-dasharray:4 3;
      linkStyle default stroke:#8C817A,stroke-width:1.5px;
  ```
</div>

## While you build

Generated browser code runs inside an isolated frame. Its network policy allows only Wisty's Salesforce endpoints on the preview's own origin.

The preview's server also runs in a separate virtual machine. Its outbound network is restricted to Wisty's backend.

Salesforce credentials remain on Wisty's servers. A separate Wisty session token authenticates sandbox requests; it's attached outside the virtual machine, where generated code can't read it.

Wisty's platform files, including the helpers that route Salesforce requests, are protected from edits. Your project files are saved separately from the temporary preview machine.

## After you publish

Viewers receive a frozen build of the version you published. Editing your project doesn't change that app until you publish again.

Published app code is served from `run.wisty.site`, a separate domain from the Wisty product. The app runs in an isolated frame with the same restrictions on external network access. Salesforce data is fetched when the viewer uses the app, rather than being included in the published files.

Opening an app requires authorization for that viewer. Salesforce requests use the viewer's own permissions and the access enabled for the app. Sharing an app never gives its viewers the builder's Salesforce access.

## Delivery and sessions

Published requests pass through Wisty's delivery edge, which exposes only the routes needed to run the app. Salesforce responses aren't cached. A short-lived runtime session authenticates requests without exposing Salesforce credentials to generated code.

Record writes use a separate path through the trusted Wisty host and its approval controls. See [How Wisty uses your data](/docs/security/data-handling) for the generation and runtime data paths, or the [security page](https://wisty.ai/security) for the full architecture and processing details.