How we protect the Service
Access to accounts and workspaces is checked on our servers for every request. Provider credentials and saved secrets are encrypted at rest and used only on our servers. API keys and session tokens are stored as hashes, not in readable form. Connections to the Service are encrypted with TLS. Each sandbox runs in the isolated environment of the compute provider that runs it, and isolation technology differs between providers.
Your part
Use narrowly scoped provider credentials, revoke keys that may have been exposed, and do not put secrets in resource names, labels or URLs. Choosing a region decides where compute runs; it is not a promise about where every record is stored. Destroying a sandbox does not automatically delete separately stored snapshots, images, volumes or provider logs.
Report a vulnerability
Email security@boxrouter.ai with the affected feature, steps to reproduce, the impact you observed and how to contact you. Please give us reasonable time to fix the issue before disclosing it publicly.
Use your own accounts and test data. Do not access or change other users' data, run denial-of-service or spam tests, keep access longer than needed to show the issue, or test providers' or other third parties' systems. We do not run a paid bug bounty. We will not pursue legal action against good-faith research that follows these rules.
Certifications and incidents
BoxRouter does not currently hold SOC 2, ISO 27001 or similar certifications, and our infrastructure providers' certifications do not certify BoxRouter. We do not offer a contractual uptime commitment unless agreed in writing. If a security incident affects your personal information, we will notify you as the law requires.