# Security

> How shedix keeps agents away from your computer and from each other: a VM per machine, an isolated network, private sign-ins, hashed tokens and links you choose to share.

shedix exists so an agent can have full control of a machine that isn't yours. Here is how that machine is kept apart
from your computer, from other machines and from us.

## A machine of its own

Every shedix machine is its own virtual machine on Google Cloud, with its own disk. It isn't a container sharing a
kernel with other people's work. The agent gets root through sudo on that machine and nothing else.

## An isolated network

Machines run on a network of their own. Traffic between machines is dropped in both directions, so one machine can't
reach another, even inside the same account. Coming in, only SSH is open, and it takes keys, not passwords. Going
out, the internet is open, so agents can install packages and call APIs.

## How you reach it

- **SSH:** with the public keys on your profile. Each machine makes its own host keys when it first boots.
- **The web terminal and VS Code** are reached through Cloudflare tunnels at random addresses. The terminal's address
  carries the machine's secret; VS Code asks for it as a password. The Files panel's server works the same way.
- **The shedix page and API** sign you in with Clerk, using Google or a one-time email code.

## Your sign-ins stay on the machine

Claude Code and Codex sign in inside the machine's own terminal, through their own sign-in flows. The sign-in stays in
that machine's home folder, and shedix never reads, stores or proxies it. A new machine never starts with anyone's
sign-in. When you copy one of your machines, the copy is made from its whole disk, so your sign-ins come along to the
copy, which is yours alone.

## Tokens

Tokens let agents and scripts use the API. A token is shown once and stored only as a SHA-256 hash. It can manage
your machines (start, stop, create, delete), but it can't make more tokens. It stops working a year after its last
use, every call it makes is listed on your profile, and revoking it takes effect at once.

## What you share on purpose

A preview link from the Ports panel is public: anyone with the link can open that port. You start each one, it's
marked as public, and it ends when you stop sharing or the machine stops. For private access, forward the port over
SSH.

## What we keep

Your account's email and name, your machines' names, sizes and history (who started, stopped or deleted what, and
when), token hashes and their activity, and the public SSH keys you add. Your files stay on your machine's disk;
deleting a machine deletes its disk.

## What isn't there yet

shedix is in a private beta. The browser tunnels use Cloudflare's quick tunnels, which have no uptime guarantee; they
will move to tunnels on our own domain. Machines run in one region (Iowa).