Your computer, still yours.

Your files, code, terminal sessions, and the work your agents do belong to you. We store them only so we can run your work, and never read them for analytics, advertising, or training AI models.

Our operational logs record only what we need to keep the service healthy, such as connection status and how much power you're using. They never contain your credentials, terminal output, source code, screenshots, commands, or file paths.

Your cloud computer runs in its own isolated environment. Other customers can't see your work, and you can't see theirs.

When you close your account, we delete your cloud computer and the data on it.

For the strongest isolation, teams can run their cloud computers in their own AWS account. Our role there can run only the named actions your CloudFormation stack defines. It can't open a shell, read logs, copy disks or change IAM, and our software there reports only setup and health, never your code, files or terminal output.

Support shell access exists only while you grant it, with an expiry. Every action is written to a security log in your account before it runs, and we can't read or delete that log.

Your team audit log in the console records setup, member, and access changes.

Your laptop and your cloud computer connect over a private network with end-to-end encryption. Your cloud computer isn't exposed to the public internet, and only devices signed in to your account can reach it.

Previews of web apps your agents are building are forwarded to your laptop privately, so they're never published online by accident.

We build this network on Tailscale, which encrypts every connection with WireGuard. Your devices connect directly whenever the network allows, and stay end-to-end encrypted when a connection has to be relayed.

So your agents can work across both machines, your cloud computer can reach your laptop while it's awake and connected. That's how agents use local files and screenshots, and run work that has to happen on your Mac, such as Xcode builds.

This connection uses the same private network, only links devices signed in to your account, and isn't available while your laptop is asleep or offline.

Sign-in is handled by WorkOS. You sign in with Google or a one-time code sent to your email, so we never store a password for you.

Data moving between your laptop, your cloud computer, and our services is encrypted in transit. Stored data, including your cloud computer's disk, is encrypted at rest with keys managed by our cloud provider.

Your agents use an account such as GitHub only after you approve it. Tokens are stored encrypted, are never written to our logs, and you can disconnect an account at any time.

For companies, admins can invite people and remove their access. Your company's admin controls are kept completely separate from our own staff tools.

Payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers.

Every change to Persistent Compute is reviewed before it ships, and our code is scanned automatically for leaked secrets. Production systems are separate from development, and secrets never live in our code.

We're building Persistent Compute to meet the controls in SOC 2 and to support GDPR and CCPA obligations. Companies can request a data processing agreement and a copy of our security documentation by emailing us.

Teams can run their cloud computers in their own AWS account. A CloudFormation stack you review and create sets exactly what we can do there. See what the stack creates and how to remove it.

We use a small number of trusted providers to run Persistent Compute. See the full list of subprocessors, what each one does, and where it processes data.

Our staff tools show accounts, billing, and the health of your cloud computer, not your files or terminal. Staff access your work only when you ask or the law requires it. Every request in our staff tools, and every command or session staff open on a hosted cloud computer through AWS, is recorded.

See how staff access to production works and how it's recorded.

If we confirm a security incident that affects your data, we'll email the admins of each affected account without undue delay, and within 72 hours of confirming it. See our incident notification commitment.

If you believe you've found a security issue, please email security@persistentcompute.ai with the details. We'll acknowledge your report within 3 business days and keep you updated as we fix it.

We won't take legal action against good-faith research that follows our vulnerability disclosure policy, which sets out scope, testing guidelines, and disclosure timing.