How Exovon Works
Exovon is a managed developer platform built on Google Cloud Platform (GCP). We handle infrastructure so you can focus on code.
The Life of a Deployment
From the moment you push code to GitHub, Exovon automates the entire compilation, container packaging, CDN distribution, and edge routing pipeline.
Push to GitHub
You push code to your repository. A secure webhook instantly notifies Exovon to start a new deployment workflow.
Build
We spin up a dedicated high-performance build instance in our Mumbai (asia-south1) region powered by e2-standard-4 (4 Dedicated vCPUs, 16 GB RAM, 100 GB SSD) with 100% sustained compute:
- Clone your repository securely via encrypted scoped GitHub tokens
- Run multi-threaded
npm installwith global cache acceleration - Compile with high-speed Rust-based SWC / Turbopack multi-threaded parallel engines
- Package dynamic application images using Sandboxed OCI Container Compilers
Build Timeouts by Plan
| Plan | Timeout |
|---|---|
| Free (Hobby) | 5 minutes |
| Cloud Starter (₹349) | 15 minutes |
| Pro (₹1,499) | 30 minutes |
| Heavy (₹3,999) | 60 minutes |
Deploy
Once the build succeeds:
- Static assets (JS, CSS, images) are pushed to Cloudflare CDN edge buckets.
- Cloud Run containers compiled via sandboxed OCI builds are registered in our Mumbai container pool.
- Containers are health-checked via TCP startup probes on Port 8080.
- Deployment follows automated traffic shifting: 0% → 10% canary traffic → 100% production shift after passing a 60-second error monitoring window (auto-rollbacks on >40% 5xx rate).
- An instant
userprojectxx.exovon.co.indeployment URL is generated. - Custom domains get instant SSL via Cloudflare for SaaS by pointing a CNAME record to
router.exovon.co.in(or Anycast A record for apex) and adding a TXT challenge record.
Serve a Request
When a user visits your application:
- DNS resolves to Cloudflare's Anycast network.
- Cloudflare CDN serves static assets from the nearest edge node (300+ global edge locations).
- Dynamic requests (API routes, SSR pages) are routed directly to our Mumbai container pool.
- Your container handles the request and returns the response seamlessly.
asia-south1)asia-south2)Infrastructure Stack
Exovon combines enterprise-grade GCP compute with global edge routing and serverless Postgres infrastructure.
| Layer | Technology | Notes |
|---|---|---|
| Cloud Provider | Google Cloud Platform (GCP) | Compute, networking, storage infrastructure |
| Containers | Docker | Isolated per-project builds and runtime isolation |
| CDN | Cloudflare | Global static asset delivery across 100+ edge cities |
| Database | Neon (Postgres) | Serverless Postgres hosted on AWS |
| Database Region | ap-southeast-1 | Low-latency regional Asia-Pacific transit to Mumbai compute |
| Container Port | Port 8080 | TCP startup probe health check listening on port 8080 |
| SSL & Custom Domains | Cloudflare for SaaS | Instant SSL provisioning via CNAME to router.exovon.co.in (or A record for apex) + TXT verification |
| Object Storage | GCP Cloud Storage | File uploads, build artifacts, static asset backups |
Database Architecture
ExoStore Serverless PostgreSQL is currently in Public Beta and 100% Free for all users across all plans (Free, Starter ₹349, Pro ₹1,499, Heavy). Managed PostgreSQL instances (powered by Neon) are located in Singapore (aws-ap-southeast-1) and provisioned on demand.
- Primary Region:
ap-southeast-1(Singapore, AWS) - Transit Latency: ~35–60ms direct network transit between Singapore ExoStore and Mumbai (
asia-south1) GCP compute containers. - Technology: Neon serverless Postgres with auto-scaling compute and decoupled storage/compute architecture.
- Connections: Pooled automatically via Neon's connection proxy — zero manual connection management required.
- Backups: Daily automated backups with instant point-in-time recovery.
- Isolation: Your dedicated database instance is physically and logically isolated from other customers.
AI & Agentic Deployment
Exovon provides first-class tools for AI agents to deploy code autonomously, while keeping security and access control strictly in your hands.
- ▸AI agents interact directly via the
@exovon/sdkCLI toolchain. - ▸All agent operations require a valid API token issued from your Exovon Dashboard.
- ▸You generate, scope permissions, and revoke tokens at any time. Agents cannot access your account without explicit token grant.
Security
Security is deeply embedded into every layer of our build, runtime, and networking stack.
End-to-End Encryption
All network traffic between users, edge nodes, and containers is encrypted with TLS 1.3.
Container Sandbox Isolation
Build containers are isolated per project with zero shared filesystems or runtime state leakage.
Secret Credential Injection
Database credentials and environment variables are injected at runtime and never written to build logs.
Edge-Level DDoS Protection
Enterprise Cloudflare Anycast network filters volume attacks before traffic touches compute pools.
Limits & Scaling
Resource allocation limits across Exovon tiers:
| Resource | Free | Starter (₹349) | Pro (₹1,499) | Heavy |
|---|---|---|---|---|
| Build Engine | 4 vCPUs / 16GB RAM | 4 vCPUs / 16GB RAM | 4 vCPUs / 16GB RAM | Dedicated Turbo |
| Container RAM | 512 MB | 1 GB | 1 GB | 4 GB+ Dedicated |
| Build timeout | 5 min | 15 min | 30 min | 60 min |
| Request timeout | 10s | 30s | 60s | 120s |
| Max payload | 3MB | 4MB | 6.5MB | 20MB |
| Bandwidth | 1GB/mo | 10GB/mo | 40GB/mo | 1,000GB (1TB) |
| Custom domains | 0 (.exovon.co.in) | 5 | Unlimited | Unlimited |
Container Sandboxing & Security Architecture
Exovon provides defense-in-depth isolation for all hosted workloads, protecting your code, secrets, and end-users with multi-layered container microkernel virtualization.
gVisor Microkernel Syscall Interception
Unlike traditional virtual servers or standard shared Docker hosts where containers share the host Linux kernel directly, Exovon isolates every application runtime inside a dedicated gVisor user-space kernel sandbox. System calls from your code are intercepted in user space, eliminating container escape vectors and protecting against host kernel vulnerabilities.
Zero-Trust Compute Isolation
Every customer application container executes under a strictly unprivileged runtime identity with zero cloud management roles. Deployed applications cannot access internal platform infrastructure, control planes, or private storage systems.
SSRF & Cloud Metadata Shielding
Our network routing fabric isolates user containers from internal VPC endpoints and metadata servers, preventing Server-Side Request Forgery (SSRF) exploits from probing cloud infrastructure.
Build Scanning & Envelope Encryption
Every deployment package is automatically inspected by pre-build security scanners before compilation starts. Environment variables and API keys are protected using authenticated AES-256-GCM envelope encryption with cryptographic tamper verification.
| Security Layer | Traditional Shared Hosting | Exovon Serverless Platform |
|---|---|---|
| Kernel Isolation | Shared Host Linux Kernel | gVisor User-Space Sandbox |
| Container Escape Defense | Vulnerable to Kernel Exploits | Syscall Virtualization Barrier |
| Runtime IAM Privileges | Root / Broad Server Rights | Zero-Trust Identity Boundary |
| Secret Storage | Plaintext Disk Files | Authenticated AES-256-GCM |
Platform Roadmap
Upcoming infrastructure expansions and platform milestones:
| Feature | Status |
|---|---|
| Mumbai hosting | ✅ Live |
| Delhi hosting | 🚧 September 2026 |
| US-East region | 📋 On request |
| Self-serve region selection | 📋 Q4 2026 |
| Managed Redis | 📋 In development |