diff --git a/packages/backend/src/om/mappings/app.js b/packages/backend/src/om/mappings/app.js
index 3a5663d5..ed9a0ab4 100644
--- a/packages/backend/src/om/mappings/app.js
+++ b/packages/backend/src/om/mappings/app.js
@@ -117,6 +117,9 @@ module.exports = {
             to: 'app',
             sql: { use_id: true },
         },
+        protected: {
+            type: 'flag',
+        },
 
         // OPERATIONS
         last_review: {
diff --git a/packages/backend/src/om/mappings/subdomain.js b/packages/backend/src/om/mappings/subdomain.js
index e1a87b71..9fc1c86c 100644
--- a/packages/backend/src/om/mappings/subdomain.js
+++ b/packages/backend/src/om/mappings/subdomain.js
@@ -94,6 +94,9 @@ module.exports = {
             to: 'app',
             sql: { use_id: true },
         },
+        protected: {
+            type: 'flag',
+        },
     }
 };
 
diff --git a/packages/backend/src/services/database/SqliteDatabaseAccessService.js b/packages/backend/src/services/database/SqliteDatabaseAccessService.js
index 5f036f01..b642b9c3 100644
--- a/packages/backend/src/services/database/SqliteDatabaseAccessService.js
+++ b/packages/backend/src/services/database/SqliteDatabaseAccessService.js
@@ -42,7 +42,7 @@ class SqliteDatabaseAccessService extends BaseDatabaseAccessService {
         this.db = new Database(this.config.path);
 
         // Database upgrade logic
-        const TARGET_VERSION = 10;
+        const TARGET_VERSION = 11;
 
         if ( do_setup ) {
             this.log.noticeme(`SETUP: creating database at ${this.config.path}`);
@@ -59,6 +59,7 @@ class SqliteDatabaseAccessService extends BaseDatabaseAccessService {
                 '0010_add-git-app.sql',
                 '0011_notification.sql',
                 '0012_appmetadata.sql',
+                '0013_protected-apps.sql',
             ].map(p => path_.join(__dirname, 'sqlite_setup', p));
             const fs = require('fs');
             for ( const filename of sql_files ) {
@@ -115,6 +116,10 @@ class SqliteDatabaseAccessService extends BaseDatabaseAccessService {
             upgrade_files.push('0012_appmetadata.sql');
         }
 
+        if ( user_version <= 10 ) {
+            upgrade_files.push('0013_protected-apps.sql');
+        }
+
         if ( upgrade_files.length > 0 ) {
             this.log.noticeme(`Database out of date: ${this.config.path}`);
             this.log.noticeme(`UPGRADING DATABASE: ${user_version} -> ${TARGET_VERSION}`);
diff --git a/packages/backend/src/services/database/sqlite_setup/0013_protected-apps.sql b/packages/backend/src/services/database/sqlite_setup/0013_protected-apps.sql
new file mode 100644
index 00000000..1f6215ab
--- /dev/null
+++ b/packages/backend/src/services/database/sqlite_setup/0013_protected-apps.sql
@@ -0,0 +1,2 @@
+ALTER TABLE apps ADD COLUMN "protected" tinyint(1) DEFAULT '0';
+ALTER TABLE subdomains ADD COLUMN "protected" tinyint(1) DEFAULT '0';