What's protected, and what isn't.

A short, concrete account of the security model, including the parts that aren't finished. If you're deciding whether to trust this machine with an unattended overnight run, the restart section near the bottom is the one you actually need.

Isolation

Your workstation is its own virtual machine (a Firecracker microVM on Fly.io) with its own persistent volume. One customer per machine. You are not a container sharing a kernel with other customers, and there is no shared volume between accounts.

Inside that boundary you have sudo and full control. Isolating you from your own projects is explicitly not a goal: it's one machine, it's yours, and everything on it can see everything else on it.

Transport

Your workstation is served over HTTPS at your own hostname, with a certificate issued for that hostname. Plain HTTP is redirected, not served. The end-to-end certificate flow (real domain, real DNS, real issued certificate) was executed and verified against the current image on 2026-07-23, not just designed on paper.

The auth gate

A gateway process sits in front of everything. It is the only publicly bound process on the machine; the terminal server and the application itself listen on loopback only and are never reachable from the network directly. Requests without a valid authenticated session don't reach them.

Your keys

Your AI provider credentials are stored by each CLI in your own home directory, on your own volume. They are never uploaded, never proxied through our servers, and never displayed in our interface: we have no key field because we hold no keys. The flip side is that we can't recover them either. See Connecting your agents.

Here is the part most hosts leave out. Your volume is encrypted at rest, but we run the machine it attaches to, so our infrastructure credentials can technically reach that disk. The same is true of every hosting company, whether or not they say so. What we do about it: we don't use that access, except when you ask us to look at something or when we have to act on a security, abuse, or legal emergency. We write down every time we do, we tell you, and we never open your credential files: if a key needs replacing, you rotate it, we don't read it. Your keys never appear in our logs, and nothing in our database has a column for them.

What we hold about you

• Your account email.
• Your billing relationship through our checkout provider: we never see your card number.
• The data inside your workspace, because it's on a disk we operate.
• Operational logs from the platform.

We do not sell your personal information. Subprocessors are Fly.io (compute and storage), our checkout provider (payments) and Resend (email). The full account is in the Privacy Note.

We don't read your workspace files as a matter of course. If we need to look at something on your machine to fix a problem you've reported, we ask first.

What survives what

This is the part people get burned by elsewhere, so here it is in full.

The promise is that your agents keep working when you stop watching. That holds across disconnects, closed laptops, and idle suspends: the machine keeps the processes and their memory, and a warm wake takes about a second (measured at 0.73-1.37 seconds on the image we ship).

It does not currently hold across a hard restart. Terminal sessions live in memory; a restart ends them and you start a fresh session. Everything written to disk is still there, untouched. Restarts are uncommon (and one is guaranteed if you ask us to resize your plan), but they are not impossible, and we would rather you plan around it than be surprised by it.

No backups

Say it plainly: the Service does not include backups. That is a statement about what we commit to, and it has not changed. We do not offer restore, we do not test it, and you should not plan around it. A persistent disk is not a backup: it protects you from a machine restarting, not from you deleting the wrong directory. Keep your work in a git remote you control, or copy it off the box.

What is true, and we would rather you heard it from us: our infrastructure provider takes automatic daily snapshots of your volume with a short retention window (about five days at the time of writing). They are not theoretical, and they are not ours to promise. We used one on 13 August 2026 to move a customer's workstation onto a new machine, so we know they work. They are also volume-level, meaning all of your disk or none of it, never the single file you deleted, and we make no guarantee that one will be available or usable when you need it.

The practical consequence: if you lose something important, ask us the same day. The window is days, not weeks, and once it closes there is nothing behind it. We would rather tell you the window exists than let you assume either that we have you covered, or that a copy never existed.

Deletion

When you cancel: your box runs to the end of your paid period, then a 14-day export window (24 hours if you were on a trial that never converted), then we delete the machine and its volume. Residual copies inside our providers' systems purge on their normal rolling cycle, up to 30 days. We won't claim instant, irreversible erasure of every copy everywhere, because nobody operating on shared infrastructure can honestly claim that.

What we don't claim

We hold no compliance certifications (no SOC 2, no ISO 27001, no HIPAA or PCI attestation), and we don't sign BAAs. This is an early-access product from a small company, and it's priced and described accordingly. If you need audited compliance for the data you'd put on this machine, we're not the right vendor yet.

Reporting a problem

Email support@holycode.cloud with SECURITY in the subject. Report privately first; we won't come after a good-faith researcher.