Security

Every agent gets its own machine

Each agent runs on its own cloud machine, with its own copy of your code, made for one task. Agents don't share a disk or a process, and nothing from our own cloud account is passed into them. An idle agent goes to sleep, and a sleeping agent is deleted after 7 days by default. Each environment can set its own limit.

It reads. It doesn't change your data.

• Every database query runs in a read-only transaction, stops after 15 seconds and returns at most 1,000 rows.
• Superuser logins and private network addresses are refused when you connect a database.
• Agents change code only on their own branch, and they hand it to you as a pull request to review.

Keys stay on our server

Database passwords, connection strings and environment secrets are encrypted at rest with AES-256-GCM. Agents reach a database through the Skyfleet server, so its password is never written to an agent's machine. Every query an agent runs is written to an audit log your team can read.

Who can use what

A connection belongs to the person who added it. They choose who on the team can use it: everyone, only themselves, or the people they pick. Each agent acts as the teammate who started it, and gets only the connections that person can use. GitHub access goes through the Skyfleet GitHub App, installed on the repositories you choose.

Where it runs

The Skyfleet server and every agent machine run in the EU, and all traffic is encrypted with TLS. The companies we rely on are listed in the DPA. If your data can't leave your network, run Skyfleet yourself: it's the same product inside your own cloud or on-prem.

Certifications

We don't have a SOC 2 or ISO 27001 report yet. If your team needs a security questionnaire filled in, email [email protected] and we'll answer it.

Report a vulnerability

Found a security problem? Email [email protected] with the steps to reproduce it. Please give us a fair chance to fix it before you share it publicly. We read every report.