Hello Ralph, You’ll be happy to know that all our servers are bound together with a WireGuard mesh which means everything is encrypted in transit. Furthermore, each organization has its private network, which we call a 6PN. For this, we use some eBPF rules to make sure things from different 6PN private networks can’t talk to each other. If you want some of your apps to be even more isolated you can pull them off the default org’s network and into a custom one by specifying the --network flag while creating the app fly apps create.
You can find more about this at these links: