Security

Where your data lives

Your computers (VMs) and the database behind the app run on BoxCompute's own servers in a colocation data centre in Cyberjaya, Malaysia. Files you upload and our off-site database backups are stored in Amazon S3 in the Asia Pacific (Malaysia) region.

Some information leaves Malaysia to reach the services that handle it: web traffic crosses Cloudflare's network, prompts go to the AI model provider behind the model you choose, and email, payments and team notifications go through their providers. The subprocessor list names each one and what it receives.

Every computer is its own VM

• Full virtual machines. Each computer is a KubeVirt VM on KVM with its own kernel, not a container sharing the host's.
• Closed network by default. A VM's network starts closed in both directions. With internet access it can reach the public internet only: private, carrier-grade NAT and link-local addresses are blocked, so it cannot reach our internal network or other customers' VMs.
• No mail relay. Outbound SMTP on port 25 is blocked for every VM.
• No network at all, if you want. You can create a VM with no network interface.

Encryption

• In transit. Browsers, apps and API clients connect over HTTPS. Cloudflare connects to our servers over TLS, and our servers accept web traffic only from Cloudflare. The app's database refuses connections without TLS, and traffic between our servers runs over an encrypted WireGuard network.
• Secrets at rest. Model keys, Vault secrets, MCP server credentials and connected-service tokens are sealed with AES-256-GCM, using data keys that AWS Key Management Service wraps. A copy of the database alone cannot open them.
• Files and backups in S3. Amazon S3 encrypts the files and off-site backups it stores.

Sign-in, API keys and connected apps

• Passwords are stored only as Argon2id hashes. Repeated failed sign-ins are slowed down, and resetting a password signs out every session.
• Sessions use HttpOnly, Secure, SameSite cookies; the server keeps only a digest of each one.
• API keys are shown once and stored only as a SHA-256 digest. Each has scopes, and a key can be limited to one workspace, so it sees and acts on that workspace's VMs and nothing account-wide. Revoking a key stops it on the next request.
• Apps you connect over MCP, such as Claude or ChatGPT, sign in with OAuth and PKCE. A BoxCompute page lists what the app will be able to do and lets you limit it to one workspace before you allow it. A replayed sign-in code or refresh token ends the connection, and you can remove it any time in API keys.

Vault: secrets your agent never sees

With Vault, included with Starter, you save a key or password once, outside the chat. Your agent can ask for one by name, and you enter it in a masked card that goes straight to the vault. The value is never shown again and no endpoint returns it. The agent passes it to one command at a time as an environment variable, after the approval your settings require, and any saved value that appears in tool output is masked before it is stored or shown to the agent.

Masking is not protection from a command you do not trust: a command can read its own environment, and copies it writes to files or the screen are not masked.

Activity you can audit

Every request your API keys, the CLI and connected MCP apps make is recorded in your API activity: the method, route, status, time, IP address and key. Request bodies, query strings, credentials and tool arguments are never recorded. Reads are kept for 31 days and everything else for 455 days. An organization's audit log of membership, settings and VM changes is append-only and kept for 455 days.

Backups and retention

The app's database is snapshotted on our servers every hour and copied to Amazon S3 in Malaysia every 6 hours, where copies are kept for 35 days. When you delete your account, its data is removed from the live service and leaves the backups as they rotate out.

Access to our servers

Our servers are administered only over our private network, with SSH keys rather than passwords. Every API request is checked against its key's account, scopes and workspace, and a suspended account loses access on its next request.

Reporting a vulnerability

If you find a security issue in BoxCompute, email [email protected] and give us time to fix it before you share it. Test only within your own account, and do not access other customers' data or disrupt the service.

See our subprocessors · Privacy policy · API key docs