Defense in layers.

1. Isolation between users

Every person works inside their own isolated container, with limited memory and CPU. No user can see, reach or affect another's space: isolation does not depend on a password, but on the system's own architecture.

When a task needs to run tools, it does so inside that same bounded space. Nothing runs "on the server in plain sight of everyone".

2. Network closed by design

• Cells have no free internet access: they only talk to the internal services they need (inference and search).
• Web search goes out over a private network between servers, not through third-party proxies.
• Internal ports listen only on the local machine; no management surface is exposed to the outside.
• The server firewall allows only what is necessary (public web, encryption and administration by key, not by password).

3. Defenses against prompt injection and escapes

A real risk for agentic assistants is that malicious content (a page, a file) tries to give orders to the system. So: the material you upload is treated as data, not as orders; workspaces are confined to the user's folder; and we apply resource limits that prevent anything from spilling into another space.

4. Accounts and access

• Passwords with strong encryption; never in plain text.
• Failed-attempt limits per email and per connection, with temporary lockout.
• Two-step verification (code app) and one-time backup codes.
• Visible active sessions with individual or bulk sign-out; changing your password closes the other sessions.
• Session cookies protected and only over an encrypted connection.

5. Infrastructure and operations

• All traffic travels encrypted (HTTPS/WSS) end to end.
• Critical secrets live outside the code and outside users' reach.
• Security updates and automatic daily cleanups.
• Service health monitoring; on failure, spaces recover without exposing anyone's data.

6. Transparency and honest limits

No serious service can promise absolute invulnerability. What we do promise: defensive design, continuous review, fast response and honesty when something happens. If we find or receive a report of a problem, we fix it and we tell it with the same frankness as this page.

Report a vulnerability

Last updated: October 12, 2026.