Isolated sandboxes
Agent sandboxes run in isolated containers in Auteryn’s cloud — separate from the rest of the platform and from other tenants.
Security
Auteryn is built for production use with encryption, isolation, and access controls. This page describes our security practices — for enterprise compliance requirements, contact security@auteryn.ai.
Security overview
Section titled “Security overview”Data encryption
Section titled “Data encryption”In transit:
- TLS for all API and Console traffic
- Encrypted WebSocket connections where used
At rest:
- Encrypted database storage
- OAuth tokens and Integration credentials encrypted with AES-256-GCM
- Sandbox artifacts and snapshots stored in Auteryn’s cloud storage
Infrastructure
Section titled “Infrastructure”Network boundaries
The agent runtime talks to the sandboxes over HTTPS. Sandboxes do not access your local network.
Resource limits
Sandboxes enforce filesystem boundaries (/workspace) and block destructive system commands.
Access control
Section titled “Access control”Authentication:
- Sign-in with Google, then short-lived signed session tokens for the Console and the workspace
- Org API keys (
sk_live_...) exchanged for scoped agent JWTs - Website keys (
site_pub_..., andwk_pub_...on older widgets) restricted to the domains you allow
Authorization:
- Role-based access control (owner, admin, member, guest)
- Per-agent integration and knowledge bindings
- Audit logging for Console actions
Data handling
Section titled “Data handling”- Knowledge content is indexed for RAG retrieval within your org
- Integration tokens are stored encrypted and refreshed automatically
- Sandbox files persist in your org’s sandbox session until cleared or the session is stopped
- Export and deletion: the owner can export the organization’s data and close it from Settings → Organization. Its content is deleted 30 days after closing. Backup copies last up to 7 days and service logs up to 90 days. See Close your organization. To skip the 30-day wait, send an erasure request to privacy@auteryn.ai or support@auteryn.ai
Reporting abuse
Section titled “Reporting abuse”To report phishing, malware or other abuse at a URL on auterynusercontent.com (preview links and share links for what agents build):
- Email: security@auteryn.ai
- Include the full URL and what the content does
- We review reports and remove content that breaks our Terms of Service
Reporting vulnerabilities
Section titled “Reporting vulnerabilities”If you discover a security issue:
- Email: security@auteryn.ai
- Include steps to reproduce and impact assessment
- We aim to acknowledge reports within 2 business days