Frequently asked questions
What isolation actually means here, what it costs, and what is still missing.
How is an agent session isolated?
Every session boots its own Firecracker microVM with its own guest kernel on KVM — not a container sharing the host kernel. The filesystem policy is declared when the sandbox is created, and the declared policy cannot be widened from inside the guest. Where the guest kernel provides Landlock, the supervisor enforces that policy with it; it probes for Landlock at startup rather than assuming it.
Can the agent reach the internet?
Not by default. A session starts with a deny-all egress policy and reaches only the destinations its own configuration names at create time — the repository host, the model endpoint, any configured MCP endpoint. Enforcement is on the host datapath, not by a proxy inside the guest that the workload could route around: the guest resolves names through a host resolver scoped to that list, and a TLS connection is forwarded only when the host it asks for is on it. Editing that destination list yourself is on the roadmap.
Which models can I use?
Any provider you already have a token for, or an EU-hosted model. Your token is stored encrypted and is never displayed again after saving. Today it is handed to the session as environment material, so the agent process can read it — treat it like any key an agent holds. Agent-blind injection, where the token never enters the agent process, is on the roadmap.
Does my code stay in the EU?
Execution and storage run on bare metal at an EU provider, so the code itself stays in the EU. Whether the whole pipeline is EU-only also depends on the model you point it at: an EU-hosted model keeps prompts in the EU, while your own token for a US provider sends prompts to that provider under their jurisdiction. We will tell you which case you are in before you commit to anything.
Does anyone at your end read my code?
No. We operate the platform with guardrails, not by watching what your agent is working on. What we cannot decide for you is the model route: prompts you send to a model provider are governed by that provider’s terms, which is why we declare the route before you commit.
What stops a runaway agent from running up a bill?
A lifetime cap per session and a runtime-minute budget per account and period, plus an idle timeout you set. At either cap the affected sessions stop — the cap is in runtime minutes, not in euros or tokens. A session that sits without work stops itself once the timeout expires. Billing runs on the wall-clock time between a session becoming ready and it stopping — we do not meter busy against idle time inside a running session, so the idle timeout is what bounds a quiet agent, not the meter.
What does it cost?
Rates are not published yet, and we are not going to invent a number for a marketing page. The model is fixed: you pay for active session runtime. Design partners receive the rate card in writing before anything is billed.
Can you sign a data processing agreement?
Not yet. The data processing agreement, the record of processing activities, the subprocessor list and the TOM document are in preparation. If your procurement process requires them signed before a pilot, we are not ready for you yet.
What is not built yet?
How do I get access?
Through the design partner programme. We are onboarding a small number of teams with real workloads rather than opening general availability.