Skip to content
- Hypervisor isolation. Every tenant is a Firecracker microVM. Sessions can install
anything, run anything, break anything — and reach only their own machine.
- Billing resolution is explicit. Whose Claude account pays for a turn: the person’s own
connection, else their tenant’s, else the workspace’s org-wide API key — never a
deployment-wide anything. Subscription sign-ins are one person each; anything shared runs on
commercial API keys.
- Credentials live in a vault. Values are AES-256-GCM sealed into rows bound to their
tenant; exactly one process can decrypt. Nothing is ever pasted into a channel: Claude
connects by sign-in ceremony, GitHub by device flow, everything else through private forms.
- Tokens expire. GitHub access is minted per boot (installation tokens, 1 hour) or per
person (user tokens, 8 hours, silently refreshed) — a disk snapshot of VM memory stops
mattering shortly after it is written.
- Per-tenant everything. No deployment-level default can shape a tenant: identities,
owners, installations and settings are explicit rows, so one customer’s configuration cannot
leak into another’s.
- One deployment, no middlemen. The machines run on infrastructure the operator controls —
code, credentials and inference traffic touch that deployment and the providers it talks to
(GitHub, Anthropic, Slack), with no additional cloud in the middle.