06 · Security

What's protected, and what isn't.

A short, concrete account of the security model — including the parts that aren't finished. If you're deciding whether to trust this machine with an unattended overnight run, the restart section near the bottom is the one you actually need.

Isolation

Your workstation is its own virtual machine — a Firecracker microVM on Fly.io — with its own persistent volume. One customer per machine. You are not a container sharing a kernel with other customers, and there is no shared volume between accounts.

Inside that boundary you have sudo and full control. Isolating you from your own projects is explicitly not a goal: it's one machine, it's yours, and everything on it can see everything else on it.

Transport

Your workstation is served over HTTPS at your own hostname, with a certificate issued for that hostname. Plain HTTP is redirected, not served. The end-to-end certificate flow — real domain, real DNS, real issued certificate — was executed and verified against the current image on 2026-07-23, not just designed on paper.

The auth gate

A gateway process sits in front of everything. It is the only publicly bound process on the machine; the terminal server and the application itself listen on loopback only and are never reachable from the network directly. Requests without a valid authenticated session don't reach them.

It fails closed. If the gateway's authentication configuration is missing or incomplete, it refuses to start at all rather than starting up unprotected. A misconfigured box is an unreachable box, never an open one. That's the correct failure direction and it's worth saying out loud.

Your keys

Your AI provider credentials are stored by each CLI in your own home directory, on your own volume. They are never uploaded, never proxied through our servers, and never displayed in our interface — we have no key field because we hold no keys. The flip side is that we can't recover them either. See Connecting your agents.

What we hold about you

Your account email.
Your billing relationship through Stripe — we never see your card number.
The data inside your workspace, because it's on a disk we operate.
Operational logs from the platform.

We do not sell your personal information. Subprocessors are Fly.io (compute and storage), Stripe (payments) and Resend (email). The full account is in the Privacy Note.

We don't read your workspace files as a matter of course. If we need to look at something on your machine to fix a problem you've reported, we ask first.

What survives what

This is the part people get burned by elsewhere, so here it is in full.

Event	Your files	Running agent sessions
You close the browser tab	Survive	Survive
You lose your connection	Survive	Survive
The machine suspends when idle, then wakes	Survive	Survive
A hard restart — crash, out-of-memory, platform redeploy, host migration	Survive	Do not survive

The promise is that your agents keep working when you stop watching. That holds across disconnects, closed laptops, and idle suspends — the machine keeps the processes and their memory, and a warm wake takes about a second.

It does not currently hold across a hard restart. Terminal sessions live in memory; a restart ends them and you start a fresh session. Everything written to disk is still there, untouched. Restarts are uncommon — and one is guaranteed if you ask us to resize your plan — but they are not impossible, and we would rather you plan around it than be surprised by it.

So: have long runs write to disk. Tee your output to a file, commit as you go, let the agent leave artifacts behind. That's good practice anyway, and here it's the difference between an interrupted run you can pick up and one you can't. Durable sessions across restart is a known open item we're building — when it ships, this section changes and we'll say so.

No backups

Say it plainly: the Service does not include backups. A persistent disk is not a backup — it protects you from a machine restarting, not from you deleting the wrong directory. Keep your work in a git remote you control, or copy it off the box. We removed backups from the offer deliberately rather than shipping a promise we weren't confident we could keep.

Deletion

When you cancel: your box runs to the end of your paid period, then a 7-day export window, then we delete the machine and its volume. Residual copies inside our providers' systems purge on their normal rolling cycle, up to 30 days. We won't claim instant, irreversible erasure of every copy everywhere, because nobody operating on shared infrastructure can honestly claim that.

What we don't claim

We hold no compliance certifications — no SOC 2, no ISO 27001, no HIPAA or PCI attestation — and we don't sign BAAs. This is an early-access product from a small company, and it's priced and described accordingly. If you need audited compliance for the data you'd put on this machine, we're not the right vendor yet.

Reporting a problem

Email support@holycode.cloud with SECURITY in the subject. Report privately first; we won't come after a good-faith researcher.