The questions we get most often

No. Tenants are isolated at row level: sessions, messages, model configs, skills and sandboxes all carry a tenant_id, and RLS enforces the filter inside the database — a missing application filter still cannot read another tenant's rows.

Tenant admins and platform admins are separate roles, and cross-tenant access is audited.

Envelope encryption before they touch the database: each record gets its own DEK, the DEK is wrapped by a KEK, and the ciphertext carries a version and key id so KEKs can be rotated. The API only returns a mask, and api_key-like fields are redacted in logs and audit entries.

In production, a missing KEK refuses the write rather than falling back to plaintext.

No. We do not train models on user conversations. Third-party model calls are governed by their own terms; the data-flow notes in the docs spell out what leaves the platform and when.

Sessions and messages can be exported; deletion follows the retention policy and removes sandboxes and preview artefacts along with the session.

Exact steps and retention windows are in the docs under Data & security.

Any OpenAI-compatible endpoint (/v1/chat/completions): OpenAI, DeepSeek, Qwen, Kimi, OpenRouter, or a local vLLM / Ollama gateway. Each config can set its own thinking parameters and default model.

The public pool only serves models we pick; it never touches your key.

By tokens (input plus output), accumulated per tenant per UTC calendar day and reset at midnight UTC.

When it runs out, new runs are refused with a prompt to add your own key; existing sessions and history are unaffected.

2 concurrent requests on the public pool, 3 with your own key, and 2 concurrent sandboxes. Over the limit you get an immediate message rather than a queue.

"Unlimited" means we do not cap tokens — your provider bills you directly. The concurrency cap protects runtime and sandbox capacity, not billing.

A sandbox is an isolated environment created on demand, where agents run commands, install dependencies, read and write files, and start servers. It is discarded when done.

Not every task needs it: pure conversation or reading docs does not; tests, builds and screenshots do.

In an isolated instance, never through your browser or your machine. The instance is reclaimed when the session ends, and files follow the session retention window.

An email address and, optionally, a model key. Without a key you can still use the public pool end to end. No credit card at any point.

Yes. The repository is open source and supports Docker and your own Kubernetes. Self-hosting is not subject to the quotas described here; the quickstart in the docs is the shortest path.

Email code or password via Clerk today, with a dedicated tenant created on first sign-in. Admins can additionally enable TOTP.