Sandbox the code
Each app runs inside its own compute, storage, resource, and network boundary.
Security for small software
Run agent-built code with explicit boundaries.
Every app starts isolated and private. It can reach only the people, data, network destinations, company tools, and actions you grant.
Four boundaries
Security is part of the runtime contract.
Isolate the tenant
Apps are isolated from each other. Workspaces are isolated from other customers.
Grant capabilities
Apps receive narrow permissions and company-tool actions—not ambient access or raw keys.
Trace the outcome
Every sensitive path preserves the user, app, delegated scope, approval, call, and result.
Runtime threat model
Generated code begins in a default-deny environment.
ComputePer-app sandbox with CPU, memory, execution-time, and concurrency limits
StorageApp-scoped namespaces and control-plane authorization on every management action
NetworkDefault-deny egress with explicit destinations or brokered company-tool calls
BuildDependency installation and build execution isolated from production credentials
OperationsRuntime patching, backups, restore testing, and bounded retention policies
COMPANY VAULT3 connections
H
HubSpotConnected by Maya
HealthyS
SlackAcme workspace
HealthyACTIVE GRANTrenewal-board → hubspot.accounts.readProduction only · short lived · revocable
Company vault
The app gets a capability, not a credential.
Connect keys, OAuth accounts, and internal services once. Apps request typed actions; raw credentials stay encrypted inside the vault. Tarantula brokers the action or issues a narrow, short-lived token only when the provider requires it.
- Scope by app, action, data, environment, and time
- Rotate or revoke a connection without editing app code
- Let apps expose approved typed tools to other apps
Approval invariant
An approval binds the human, tool, arguments, environment, expiry, and one execution. Any payload change requires a new approval.
Arbitrary code, bounded runtime
Generated code starts with almost nothing.
NetworkDenied unless explicitly allowed
Company dataOnly through authorized app APIs
SecretsNever readable as raw credential values
Other appsOnly explicit typed tool calls
Sensitive actionsBound to the exact approved payload
Private-alpha status
Clear about what is ready and what is not.
Per-app sandboxing, workspace isolation, default-deny egress, vault grants, bound approvals, audit traces, backups.
Independent security review, dependency policy, incident runbooks, expanded connector hardening.
SOC 2 report, HIPAA workloads, on-premises deployment, or formal enterprise support SLAs.
Design partners