Security

The isolation boundary is enforced by the platform, not the agent's judgment.

AI coding agents run arbitrary shell commands by design. Ovrin's security model assumes every sandbox will eventually run something it shouldn't — and contains the blast radius to that one sandbox.

01

Kernel isolation

Every sandbox runs inside gVisor, a user-space kernel that intercepts syscalls rather than sharing the host kernel with your workload. A compromised agent process cannot reach the host kernel the way it could escape a bare container.

02

Default-deny egress

New sandboxes cannot reach the network at all. Outbound access is granted per-host on an explicit allowlist enforced at the DNS and packet-filter layer (dns+nft) — not by the agent's own good behavior, and not bypassable from inside the sandbox.

03

Ephemeral by default

A sandbox's filesystem, process table and memory exist only for its lifetime. Killing it destroys all of it. Nothing persists across sandboxes unless you explicitly write it to Memory.

04

Tenant isolation

Every sandbox is scheduled with dedicated cgroup and network-namespace boundaries. No project can observe another project's sandboxes, secrets, or usage.

Defense in depth

Six layers, each independently enforced.

ComputegVisor sandbox, 1 sandbox : 1 agent session, dedicated cgroups

NetworkDefault-deny egress, per-project allowlist, DNS + nftables enforcement

FilesystemEphemeral overlay, wiped on kill, no cross-sandbox mounts

SecretsInjected as env vars at boot, encrypted at rest, never written to logs

Memory / stateOpt-in persistence, encrypted at rest, scoped to your project

Control planeTLS 1.2+ in transit, encrypted at rest (AES-256), audit-logged API calls

Network policy

Nothing resolves unless it's on the allowlist.

Policy is per project and applies to every sandbox booted under it, regardless of template.

ALLOWapi.anthropic.com · api.openai.com · …

ALLOWgithub.com · your git host

ALLOWpypi.org · registry.npmjs.org

DENY* everything else, including raw IP egress

Configurable per project from the dashboard or the API. Requests to non-allowlisted hosts fail closed — they don't queue, retry against a fallback, or leak DNS.

Compliance & disclosure

Where to look for the paperwork.

SOC 2 Type IIIn progress — report available under NDA to Enterprise customers on completion.

Data Processing AgreementStandard DPA with SCCs available to every customer. See /dpa.

Sub-processor listMaintained and disclosed in the DPA; customers are notified of material changes.

Responsible disclosureReport vulnerabilities to security@ovrin.app. We acknowledge within 2 business days and do not pursue legal action against good-faith research consistent with our program.

The policies that back this up.

Acceptable Use Policy

What agents are and aren't allowed to do on the platform.

Privacy Policy

What we collect, how AI-processed data is handled, and your rights.

Data Processing Agreement

Sub-processors, international transfers, and SCC terms.

Give the agent a boundary, not the benefit of the doubt.

Create an API key Report a vulnerability