Agents open untrusted pages and run code they wrote a moment ago. Here's how Boxline keeps that work contained.
gVisor implements the Linux system-call interface in user space, so processes in a session don't talk to the host kernel directly. The platform refuses to start a machine without it.
A session belongs to one customer. Its browser, shell and disk are never shared with another customer's sessions, and its machine is never reused.
MicroVM isolation is on the roadmap. We'll announce it in the changelog when it's available.
Network policies around every session machine decide who can reach it and what it can reach.
A session machine accepts connections from Boxline's API servers only, on the browser's and the session daemon's ports. Every connection first checks that the machine is still the one the session was given.
Machines can't reach private networks, the cloud metadata service or any other part of the platform, and they resolve names through public DNS, not the cluster's.
Fetch, screenshot, PDF, extract and crawl load pages in a session machine, never on the API servers that hold the database and storage.
Our proxy providers' credentials live in a separate egress gateway. A machine holds only a short-lived token for its own session, and your own proxy must be on a public address.
Machines carry no cloud keys and no service tokens, so code that runs in a session, or a page it opens, has nothing of ours to steal.
API keys are stored as SHA-256 hashes and shown to you once; revoke one at any time. Console passwords are stored as salted scrypt hashes.
Connect, live view and terminal links carry a signed token that stops working when the session stops. Rotate them at any time, and we never write them to logs.
Save a password as a credential, or pass it as a variable, and the agent types it as a placeholder such as %SHOP.password%: the value is filled in on the server right before the action, for a credential only on the sites you saved it for, and never sent to the model or kept in steps and logs.
CredentialsPasswords for your own proxies are encrypted, and the API never returns them.
The API, console and site use TLS 1.2 or newer, with plain HTTP redirected. The database, stored files and machine disks are encrypted at rest.
Requests are authenticated with your API key in the x-api-key header. A ready machine comes from the warm pool.
The browser, shell and /workspace disk all live inside the session's sandbox, with its own CPU, memory, disk and process limits. sudo is root inside the sandbox only.
Billing stops the second a session stops. Its whole browser and the files in /workspace are saved (the browser sealed with AES-256-GCM, on top of the store's own encryption) so you can resume the session on a fresh machine. The old machine is deleted, never reused. A stopped session is free, and is kept for your plan's retention days: Free 7, Hobby 30, Startup 30, Scale 90.
Delete a session, or let its retention days pass, and what it saved, its recording, its logs and its pages are deleted. This cannot be undone, so download what you want to keep first. Only the record of its usage and cost stays, for billing.
Your content runs your sessions, with one exception you control: the Trajectories program, on by default, builds AI training datasets from eligible sessions after removing personal data and secrets. Turn it off at any time. We look at session content only to investigate abuse, a security incident or a lawful request.
Privacy PolicyBoxline doesn't hold SOC 2, ISO 27001 or HIPAA certifications or attestations yet, so don't use it for work that requires them. An independent security review is planned; this page will say when it's done.
You're responsible for what your sessions and agents do. No unauthorised access, fraud, spam, attacks, or getting around a site's protections where it doesn't allow it. We may stop sessions and suspend accounts that break the rules.
Acceptable Use PolicyWe appreciate responsible disclosure. Email us with details and steps to reproduce, give us a reasonable time to fix it before you share it, and don't access other customers' data while testing. To report abuse from a Boxline session, see the Acceptable Use Policy.