Isolated sandboxes
Agent sandboxes run in isolated GKE containers on GCP — separate from the control plane and from other tenants.
Security
Security
Section titled “Security”Auteryn is built for production use with encryption, isolation, and access controls. This page describes our security practices — for enterprise compliance requirements, contact security@auteryn.ai.
Security overview
Section titled “Security overview”Data encryption
Section titled “Data encryption”In transit:
- TLS for all API and Console traffic
- Encrypted WebSocket connections where used
At rest:
- Encrypted database storage
- OAuth tokens encrypted with AES-256-GCM in the integration service
- Sandbox artifacts and snapshots stored in GCS (Google Cloud Storage)
Infrastructure
Section titled “Infrastructure”Network boundaries
The agent runtime (AWS) talks to the sandbox control plane (GCP) over HTTPS. Sandboxes do not access your local network.
Resource limits
Sandboxes enforce filesystem boundaries (/workspace) and block destructive system commands.
Access control
Section titled “Access control”Authentication:
- Firebase login with session JWTs for Console and workspace
- Org API keys (
sk_live_...) exchanged for scoped agent JWTs - Widget public keys (
wk_pub_...) restricted by domain allowlist
Authorization:
- Role-based access control (owner, admin, member, guest)
- Per-agent integration and knowledge bindings
- Audit logging for Console actions
Data handling
Section titled “Data handling”- Knowledge content is indexed for RAG retrieval within your org
- Integration tokens are stored encrypted and refreshed automatically
- Sandbox files persist in your org’s sandbox session until cleared or the session is stopped
- Delete requests: contact support@auteryn.ai for org data removal
Reporting vulnerabilities
Section titled “Reporting vulnerabilities”If you discover a security issue:
- Email: security@auteryn.ai
- Include steps to reproduce and impact assessment
- We aim to acknowledge reports within 2 business days