Trust center
Hard limits. Built in.
Every session gets its own firewall, its own ceiling and a clean end. Nothing to configure.
| Rule | Source | Result |
|---|---|---|
| in 22/tcp | 198.51.100.7 | allow |
| out 25/tcp | any | drop |
| in * | any | drop |
- SSH key
- yours, this session only
- Ceiling
- the booked maximum
- At the end
- machine and disk deleted
Network
Closed by default.
The firewall is created with the machine, before you can reach it, and deleted with it.
Controls
What every session gets.
Firewall per session
Inbound: TCP 22 from your IP. Everything else dropped. No IPv6.
Datacenter sessionsKey-only SSH
Your public key, installed for this session. Never a private key.
Datacenter sessionsNo outbound SMTP
TCP 25 closed. Send mail through an authenticated relay.
Datacenter sessionsCost ceiling
The booked maximum, held from credit. A booking above available credit is refused.
Every bookingDeleted at the end
Machine and disk deleted when the session ends. Leftover VMs are swept.
Datacenter sessionsAppend-only audit log
Every account, session and admin action. Credit in an append-only ledger.
Platform
Platform
Stop switches. A narrow agent.
Kill switch
One switch pauses new datacenter sessions. Running ones can be stopped at once.
Outbound-only agent
Provider machines open no port and run no remote commands.
Signed heartbeats
Ed25519 key per machine. The private key never leaves it.
Accounts
Verified email, hashed passwords, sign out everywhere, invitation-only sign-up.
Strict web policy
No inline script, no third-party script. Errors never carry stack traces.
Reconciled usage
Partner usage checked against the provider's invoices.
Responsible disclosure
Found a vulnerability?
Tell us first. We confirm receipt and work with you on the fix.
Please
- Send the steps to reproduce, the impact, and the affected URL or command.
- Test only against your own account and your own sessions.
- Give us reasonable time to fix before any public disclosure.
Out of bounds
- Accessing, changing or deleting other people's data.
- Denial of service, spam, social engineering, physical attacks.
- Attacks on our datacenter partners' infrastructure.
Request access.
Invitations go out by email.