Isolated runs
- Every run works in its own isolated sandbox, kept apart from other runs and other customers.
- Agents cannot push to your repositories. Their changes come back as a pull request for you to review.
Your credentials
- Model-provider keys and the access tokens you connect are encrypted before they are stored.
- A run gets your provider key only while it is running, and access ends when the run ends or when you disconnect the key.
- AOSplane API keys are stored only in a form we cannot reverse. We cannot show or recover a key after it is created.
One thing to know. Your agent uses your key to call your model provider, so code the agent runs can read that key while the run is live. Use a key created only for AOSplane, set a spending limit on it with your provider, and rotate it if you think it was exposed.
Access to your data
Only a small number of AOSplane staff can access customer accounts, and only to support you. Each time a staff member asks to act as one of your users, it is recorded.
Audit trail
Every run leaves a record of what happened: when it started and stopped, the permissions it asked for and who approved them, and the commands it ran. The record is tamper-evident, so a missing or changed entry shows. You can see it in the console for the period your plan includes.
Your data
Your data is stored in the United States. We do not use your code, prompts or other content to train AI models. The Privacy Policy covers what we collect, how long we keep it, and the companies that help us run the service.
Reporting a vulnerability
If you think you have found a security issue in AOSplane, write to security@aosplane.io with what you found and how to reproduce it. We will confirm we received it and tell you what we find.
Please give us reasonable time to fix an issue before you disclose it publicly. Test only against accounts you own, and stop if you reach data that is not yours. We will not pursue research done in good faith that respects our users’ data and privacy and does not degrade the Service for others.
Security questions and questionnaires
If your team is reviewing AOSplane and needs answers to security questions or a questionnaire filled in, write to security@aosplane.io.