Security

Sleevecast is built so that the cloud manages your agents without holding what matters most: your model keys in the clear, your agents' memory, and what they say. This page explains how.

Your model keys are sealed in your browser

When you add a key, your browser encrypts it to the public key of each of your Docks (X25519 sealed boxes) before it leaves the page. Sleevecast stores only those sealed copies and a fingerprint; it cannot open them. Each Dock opens its own copy and hands the key to your sleeves inside your machine. Adding a Dock later means sealing the key again, from your browser.

Your machine connects out, nothing connects in

The Dock opens one outbound connection on port 443 to connect.sleevecast.com. You open no ports and need no VPN. Each organization has its own isolated message account, and each Dock its own credential that can only use its own subjects; removing a Dock revokes it at once.

What stays on your machine

• Memory: each sleeve's memory lives in the Dock's local store, on your disk.
• Traces: a sleeve's step-by-step trace is forwarded only while someone has its Observe tab open, and is never stored in the cloud.
• Conversations: a message and its answer pass through the cloud while they happen and are not kept. The audit log records who sent a message and its length, never the text.
• Events: the Dock forwards only lifecycle metadata (a task completed, a guard tripped), never the task text.

Only signed software runs

The Dock and the sleeve runtime are container images pinned by digest and signed with a key that never leaves the publisher's machine. A Dock refuses any image whose signature does not verify, so even a compromised registry or control plane cannot make it run something else.

Hardened containers

• Sleeves run as a non-root user, with a read-only root filesystem, all Linux capabilities dropped, no new privileges, and CPU and memory limits.
• The Dock reaches Docker through a socket proxy that allows only the calls it needs; the Docker socket is never mounted into the Dock or a sleeve.
• Specs cannot name an image, mount host folders or grant a shell.

Accounts and access

• Sign-in goes through our identity provider at auth.sleevecast.com.
• Every organization has roles (Owner, Architect, Operator, Viewer), checked on every request by the control plane.
• Organization API keys can only message the sleeves they name. They are shown once and stored as a hash.

Report a vulnerability

Please report security issues privately through the beta contact you were given, or with the form on the beta page marked "security". We reply as soon as we can and keep you informed until it is fixed.