Every agent runs in its own sandboxed container with its own private storage and its own secrets. The runtime image is pinned by digest, so what runs is exactly what we reviewed. Nothing is shared between agents — or between customers.
Third-party skills are the biggest attack surface in the agent ecosystem, so none reach your agent raw: skills only install from sources our policy allows, each one is reviewed by a human and scanned for malware first, and security overrides are never bypassed.
Usage runs on prepaid credits, metered from the runtime’s own session records — every channel counted, including Telegram. You can set a hard monthly token cap per agent, you’re warned before credits run low, and everything stops at zero. No surprise bills, ever.
API keys you grant your agent live in an encrypted vault (AES-256-GCM). They’re injected into the sandbox as environment only — never written to disk, never returned by any API, and your agent can use them but can’t read them back to anyone in chat.
Incoming messages pass a filter that blocks credential-fishing and prompt-injection patterns before they reach your agent — and logs the attempt. Behind that, an immutable operating policy in the agent’s core instructions refuses exfiltration even if something slips through.
Export your agent’s full memory, conversations, and knowledge as an archive, plus its configuration as JSON, any time from Settings. Exports work even if your balance is zero or your account is paused. Leaving must always be possible; that’s what makes staying a choice.
No single guardrail is trusted to hold. A request has to get past all of these:
New agents get chat, memory, and knowledge — no terminal, file, or browser tools unless you switch to advanced mode yourself.
An immutable rule layer in every agent’s core instructions: never reveal secrets, never act against its owner, refuse exfiltration.
Known credential-fishing and jailbreak patterns are blocked at the door and logged, before the model ever sees them.
Tokens and keys exist only in process and container memory — encrypted at rest, never on the sandbox’s disk, never in an API response.
We hold no formal certifications today — SOC 2 readiness is on our roadmap, and we'd rather tell you that plainly than print a badge we haven't earned. Everything above, however, is running in production right now, not a promise.
Launch an agent in about a minute — 100 free credits, hard caps from day one, and your data always one click from the door.
Create your agent