Skip to content
- Every app, static site, cron job and service runs in its own container under gVisor, a sandbox with its own
kernel between your code and the server, with its own memory and CPU limits.
- Each workspace has its own private network. Other workspaces can’t reach your nodes. Isolated groups narrow that
further, inside a workspace.
- Containers can’t reach the platform’s private addresses or cloud metadata, and can’t send mail directly on SMTP ports.
- Linux boxes and agent sandboxes run as isolated system containers, separate from other users.
- All public addresses use HTTPS, with certificates issued and renewed automatically.
- Nodes are private until you make them public. Allowed IPs, domain rules with passwords, and IP allow and block
lists narrow access further.
- Databases and caches are reachable from outside only when an owner turns on external access, only from allowed IPs,
only over TLS, and never as root.
- Environment values, secrets and stored tokens are encrypted at rest (AES-256-GCM).
- Values are write-only for the CLI, API tokens and AI agents, never exported, and masked for roles that may not see
them. The activity log records key names, never values.
- Personal access tokens are stored only as hashes and shown once.
- Workspace settings → Pushed code → Refuse to build code with secret-looking files refuses builds of uploaded or
pushed code containing
.env files, private keys or credential-looking text (AWS, GitHub, Stripe, Slack keys). With
it off, those builds go ahead with a warning. Uploads always leave secret-named files out.
- Roles per workspace, optional deploy approval, and an activity log of every change, including those made by tokens
and AI agents.
- AI agents only stage changes unless you grant
deploy, and can then only deploy the exact plan they showed.
- SSH to boxes uses keys only, with limits on sessions and bans for repeated failures.
