Who Is Sandstorm For and Where Can You Run It?
Sandstorm is for individuals, teams, and organizations that want to run open-source web apps without managing each app's installation, updates, and access control by hand. You can run it on a variety of cloud hosting services or install it on your own machines, and the site says you can move between those options at any time while keeping the same apps.
Who it's for
The Sandstorm homepage frames the platform around three groups:
- Individuals who want a personal cloud server and a simple way to run web apps. Installing an app is described as being as easy as installing an app on your phone: find it in the App Market and start using it in a few clicks.
- Teams that need shared documents, files, tasks, and chat in one place. The site lists Etherpad for document editing, Davros for file storage, Wekan for task and project management, and Rocket.Chat for chat as examples of what runs on the platform.
- Organizations with security, regulatory, or data privacy requirements. Sandstorm's unified access control covers data from every app, and self-hosting gives the organization complete control over where data is stored.
A useful way to decide: if your main goal is to run one specific app and you're comfortable maintaining that app's server, dependencies, and updates yourself, Sandstorm's value is less obvious. If you want several apps with consistent access control, automatic updates, and one place to find everything you create, that's the case Sandstorm is built for.
Where you can run it
Sandstorm separates where the platform runs from what runs on it:
| Option | What it means |
|---|---|
| Cloud hosting services | Run Sandstorm on a variety of hosting providers |
| Your own machines | Install Sandstorm on hardware you control |
| Moving between them | The site states you can move between these options at any time |
The key claim is that no matter where you run Sandstorm, the apps are the same. That matters if you start on a hosted option and later want to bring everything in-house, or the reverse.
What you get regardless of where it runs
- App Market installation. Apps are installed from a market rather than assembled from source, and every app comes with automatic updates.
- One place for your data. Sandstorm keeps a list so you can find everything you create, across all apps.
- Unified access control. Access control covers data from every app, and everything is private to you by default.
- Grains as the unit of isolation. Each document, chat room, mailbox, notebook, or blog you create is a "grain" containerized in its own secure sandbox. A grain cannot talk to the world without express permission, and all grains stay private until you share them. Sandstorm states this automatically mitigates 95% of security vulnerabilities.
- Revocable access. Because Sandstorm manages access control on every document, it can show who has access and let you revoke that access at any time.
- No walled garden. You can mix and match apps from multiple developers and add your own apps as needed. Many Sandstorm apps are open source.
How to check it before committing
The homepage offers two low-commitment entry points: an Online Demo and a Get Sandstorm path. If you're evaluating it for an organization, the more informative step is to look at the apps available on Sandstorm and confirm the ones your team actually uses are present, then review the security model documentation, since the sandboxing and access-control behavior is the main thing that distinguishes Sandstorm from installing each app yourself.
One caveat worth noting: the homepage describes Sandstorm as an open-source project built by a community of volunteers. That's relevant to expectations around support and release cadence if you're choosing it for an organization rather than personal use.