Technology and security
No server to run means no server to break into
Ducseo runs on Cloudflare's edge network, and the code, database, images and inquiries all live in your own Cloudflare account. Here is how it is built, and why that makes it safer and easier to own.
Architecture
Every layer sits in your own Cloudflare account
Cloudflare Workers
The website runs on Cloudflare's global edge, close to every buyer, with no server to log into or patch.
D1 database
Products, pages, posts, inquiries and accounts live in D1 (built on SQLite), with Time Travel point-in-time recovery.
R2 storage
Product photos, certificates, PDFs and inquiry attachments live in R2; images are served from a custom domain without using site requests.
Edge caching
Pages are cached at the edge after the first visit and refreshed automatically when you publish, so most visits are served from cache.
Turnstile bot protection
Inquiry forms and dashboard sign-in use Cloudflare Turnstile, plus a honeypot field and per-IP rate limits.
Daily backups
The database is backed up to your own R2 every day, 30 copies kept, downloadable from the dashboard and restorable to a new site.
Why no VPS and no PHP
Export websites get hacked or stuffed with spam links mainly for two reasons: the server's operating system and software are not patched in time, and plugins or themes in PHP systems such as WordPress have vulnerabilities. Both need someone to maintain them for years, and most factory websites have nobody doing that after launch.
Ducseo removes both problems by design:
- No server needed: the code runs in Cloudflare Workers' isolated environment; there is no SSH and no operating system for you to maintain.
- No plugins needed: every feature is part of one codebase upgraded centrally by Todd, so there are no third-party plugin holes.
- No raw HTML: body text from every source, AI included, is Markdown, filtered against an allow-list on save;
<script>cannot get in. - No SVG uploads: SVG can carry scripts, so the media library accepts only common image formats and PDF.
- Passwords and keys: dashboard passwords are salted and hashed, API keys are stored only as hashes, and email and bot-check secrets live only in Cloudflare Secrets.
No website is perfectly safe, but the attack surface you have to worry about is far smaller.
Why the data lives in your account
Inquiries are an exporter's most valuable data. On a platform account, the platform can see them and you lose them when you stop paying. Every Ducseo site is deployed in a Cloudflare account the client registers; Todd is only an invited member, and the client can remove him at any time.
Is Cloudflare's free plan enough?
Ducseo is designed around the free plan's limits, and most B2B websites run within them:
| Resource | Free allowance (per Cloudflare's current terms) | What Ducseo does |
|---|---|---|
| Worker requests | 100,000 a day | Static files and images bypass the Worker; pages are cached at the edge |
| D1 database | 5 million rows read a day, 5 GB | Indexed, paginated lists; logs are pruned |
| R2 storage | 10 GB | Upload size limits |
When traffic grows, move to the paid Workers plan (about USD 5 a month); no code changes.
Technology questions
I already have a domain and company email. Will they be affected?
The domain moves its DNS to Cloudflare (a nameserver change). Existing MX, SPF and other email records are copied over first, so company email keeps working.
Will my old website's rankings be lost?
301 redirects can be imported in bulk to point every old URL to its new page, and after launch the 404 log shows any old URLs that were missed.
How fast is the website?
Pages load no JavaScript by default; only the inquiry basket, mobile menu and forms add small scripts. Fonts are self-hosted, images are responsive and lazy-loaded, and HTML is cached at the edge.
Is the site fast in mainland China?
Ducseo is built for overseas buyers and is fast abroad. Access to Cloudflare from mainland China is inconsistent, and Ducseo does not optimize for it.
Want to see it in action?
The demo runs exactly the same code as client sites.