شبكة The ummah's own cloud.
git push, get a live URL — on infrastructure screened to your values. No hyperscalers, interest-free billing.
- Screened, not assumed
- Every provider passes a written screen on ownership, jurisdiction, supply chain, energy and labour, published with its caveats.
- Free to leave
- A provider can go dark, or go somewhere you will not follow. Your app runs on a second one from the start, so switching is a click rather than a quarter. Disaster recovery is what that buys you on the way.
- Interest-free by construction
- Prepaid credit and bank transfer. No interest-bearing constructs anywhere in billing. A requirement, not a payment option.
How it works
Three steps, and the third one tells you the truth about itself, including when it goes wrong.
Connect
Connect a repo from your git provider and we register the deploy webhook
for you, so you never see a webhook URL. Or install the CLI:
curl -fsSL get.shebaka.com | sh
Push
We build it. A Dockerfile if you have one, an autodetected build if you don't, and the same image goes to your standby on a second provider in the same run.
Get a URL
An HTTPS URL on *.apps.shebaka.com, certificate issued on demand.
Point your own domain at it whenever you like.
==> source code.shebaka.com/anmustafa12/hello 8f3c2a1
==> build Dockerfile → registry.shebaka.com/anmustafa12/hello:8f3c2a1
Step 8/8 : CMD ["node","server.js"]
---> pushed in 34s
==> waiting for rollout
deployment "hello" successfully rolled out
==> deploying standby to digitalocean · nyc3
deployment "hello" successfully rolled out
==> checking the URL
URL check: hello-anmustafa12.apps.shebaka.com answered HTTP 200 on port 3000
URL: https://hello-anmustafa12.apps.shebaka.comThat last check exists because a ready pod is not a working URL. If your container listens on a port the service doesn't forward, the rollout succeeds and you get a 502 behind a green dot. So we probe the real edge path after every rollout and write the answer into the log. When nothing answers, the app reports unreachable instead of a green dot, with the port editable from the console.
Reliability
What we target, what is actually running, and what happens when a provider underneath us does not. The full recovery story — standbys, backups, RPO/RTO — is written plainly on the reliability & recovery page.
- Availability
- A stated target rather than a contract with credits. We would rather be transparent from day one, so what is actually happening is published as it happens, incidents included. Status and incidents 99.5% target
- Two providers, from the start
- Turn on DR and every rollout deploys to your standby provider as well, so it is never a cold copy of last month's build. The edge moves traffic itself when the primary stops answering. This is the thing you want in place before you need it, not the migration you scope after a provider disappoints you. Standby included
- Failover
- Stateless apps, automatic when the primary stops answering and one click when you simply want to move. Drilled across providers and back, with the probe counts published. RTO ≤ 5 min
- Database recovery
- Daily base backup plus WAL shipping, off-node, with the restore rehearsed rather than assumed. Databases restore rather than follow, and we would rather say so here than have you find out during an incident. RPO ≤ 24 h
Pricing
A monthly amount plus what you actually use, itemised. New accounts start with trial credit — enough for one app and a small managed Postgres (5 GB) — so the first deploy needs no card.
Startup
Founders and small teams shipping their first services.
$20 /month
+ usage, billed monthly
- Apps, managed Postgres, custom domains
- Warm-standby DR across providers
- Itemised monthly statements
- Community support
Org
Islamic organisations, charities, and SaaS teams with a board to answer to.
$200 /month
+ usage, billed monthly
- Everything in Startup
- Onboarding and migration engineering
- Residency guarantees
- Invoiced billing
Research
Research groups and eligibility-gated academic work.
Talk to us
Priced per engagement
- Eligibility-gated
- Quota'd queues
- Never advertised as a list price
Itemised, every month
Each statement line names the service, the quantity, and the amount billed, starting with the plan line. Then subtotal, credits applied, amount due.
Spend caps
Set a cap and get alerted against it, and nothing is ever hard-stopped without a human conversation first.
Trial credit
New accounts get credit at sign-up, so you can deploy before you decide. It draws down first, and we tell you when it is going.
Prepaid and bank transfer
Pay ahead by transfer and draw the balance down. There are no interest-bearing constructs anywhere in billing. That is the construction, not a setting.
Provenance
Anyone can say "ethical infrastructure". This is the part that is checkable: who owns the machines, under whose law they sit, and what we found when we asked.
| Provider | Screen | In service | What you should know |
|---|---|---|---|
| Hetzner | Passed | Yes | German GmbH, founder-owned, short ownership chain. Owns and operates its own facilities and its own backbone, so no hyperscaler capacity is resold anywhere in the delivery chain. EU and Finland campuses only. |
| DigitalOcean | Conditional | Yes, labelled per region | Own hardware, not a reseller, but a US parent means CLOUD Act reach regardless of where the facility sits, and the facilities are leased third-party colocation. Excluded from sovereign-residency claims, and marked on the region itself so you see it where you choose. |
| Scaleway | Passed | Not yet | French, iliad group, own facilities in the Paris region. Screened and cleared; not currently carrying workloads. Listed because you should be able to see the bench, not only the field. |
Ownership
Traced to natural persons through registry extracts, not to a holding company and a shrug.
Jurisdiction
Whose law reaches the data, including parent-company reach that survives moving the machines.
Upstream
Divestment and BDS screening through the whole chain, plus ASN and facility checks to catch quiet resale of hyperscaler capacity.
Energy
Measured PUE, and the instrument behind a renewables claim. A certificate and a PPA are not the same promise.
Labour
Conduct in construction and operations. Recruitment fees and passport retention are named questions, not implied ones.
Exit rights
Attestation, audit and exit clauses in the contract, so a divestment is a worker-pool migration rather than an argument.
Every provider is re-audited annually, and one that stops passing loses the workloads, which is only a credible threat because a second provider is always live.
Read the full provenance record The seven weighted criteria and their hard gates, how the upstream check actually runs, a dossier per provider, and the exit clauses every contract has to carry.Shebaka AI
On the roadmap, not on sale. Here is exactly how far it has got.
CoreWeave starts at eight H100s and a sales call. We start at one GPU and a git push.
The software layer of an AI cloud is already running here: an OpenAI-compatible endpoint, per-tenant API keys, per-token metering that lands on the same monthly statement as your apps, and quota admission for queued jobs.
What is missing is the GPU. Until one is contracted and serving there is no model catalogue, no rate card, and nothing to buy, so we are not going to print one. The GPU supply gets the same screen as the rest of our infrastructure.
If you have a workload that would use this, we would rather it shaped what we build first.
Join the GPU beta- Built OpenAI-compatible endpoint, one base-URL change from the SDK you already use
- Built Per-tenant API keys, rotatable
- Built Per-token metering onto your existing statement
- Built Quota admission for queued training jobs
- Not yet A GPU under contract
- Not yet A model catalogue
- Not yet Published GPU pricing
Your own cluster, your own region, run by us.
For organisations that need the isolation on paper as well as in practice: a named region, a cluster nobody else is on, and someone who picks up.