Trust and security

Every tool on the machine — the editor, the terminal, the file manager, n8n, everything you add later — binds to 127.0.0.1 with its own login switched off. None of them are reachable from the internet, and none of them are deciding whether to let you in.

The one process listening on a public port is the HTTPS gateway, and it is the single authentication boundary. That is why the tools have their own logins disabled rather than set to a password: two authentication systems means one of them is the weakest, and it is never the one you were thinking about.

Model access is yours — you bring your own Anthropic, OpenAI or Google key, and what you spend with it never touches this bill. The key goes into a file on your machine that every tool reads, so you set it once. It is seeded empty and from then on it belongs to you.

Nothing sends it anywhere. We do not proxy your model traffic, we are not in the path of a single request an agent makes, and the file is never part of what the machine reports. If we were in that path you would be trusting us with a second thing, and there would be a reason to.

A machine posts a short report about once a minute so the dashboard can show you whether it is healthy. This is all of it:

• Which version of the agent software it is running.
• How many tools are ready, failed or blocked — and which ones by name.
• CPU, memory and disk use, uptime, and whether security updates are waiting.
• Its hostname, architecture, and when the TLS certificate expires.
• How many dashboard sessions are open — a count, never a session id.
• The fingerprints of the SSH keys it accepts — never the keys themselves.

There is no file content in it, no code, no environment, no command history and no keystrokes. And a report cannot decide anything: it is written by the root user on your machine, so it is treated as a claim about the machine rather than proof of one. It may not move money, change what you are entitled to, or affect which machine belongs to whom.

Machines get recycled — it is cheaper than buying a new one, and the saving is part of why the price is what it is. A recycled machine cannot be handed to the next customer until its disk has been wiped.

The evidence we accept for that wipe is a changed SSH host key — not a successful call to the provider’s API, and not port 22 answering again. An API that returns 200 and quietly did nothing is the exact failure that would put your files in front of a stranger, so it is not something the system is allowed to believe.

We hold an SSH key on your machine. It is what re-issues your dashboard link when a session lapses, what applies fixes, and what lets support look at a fault. If you would rather we did not have it, run vmbox detach as root on the machine and it is gone.

It is worth being clear about the cost, because there is no re-attach — putting our key back would need a credential the machine no longer accepts. After detaching, a lapsed session can only be recovered by a reinstall, which destroys the disk; no fixes or updates reach the machine again; and support cannot look at a fault. Your lease and your billing carry on unchanged.

There is no SOC 2 report, no ISO 27001 certificate and no penetration-test report — and no work in progress towards one, so this is not a “coming soon”. If a compliance framework is a requirement where you work, this product does not meet it today.

Backups depend on the plan. The ones that include a backup are built with the provider’s automated backup — a snapshot in the provider’s systems, not a restore you can run yourself — and the entry plan has none; the pricing table says which is which. There is no uptime guarantee on any of them. Both are in the terms and both are said again in the purchase flow, because they are the two gaps most likely to actually hurt somebody.