Security
Your agent, exposed on purpose — and only to you
An AI agent on the public internet is only useful if it is also protected. Here is exactly how GridRocket isolates, encrypts and gates every machine we launch.
HTTPS on every machine, automatically
Each machine gets its own subdomain on gridrocket.cloud and a certificate issued and renewed for it automatically. Agent traffic is never served over plain HTTP, and you never touch a certificate file.
One tenant per machine
Your agent runs on a dedicated cloud machine, not in a shared runtime alongside other customers. Nothing about your workload is co-scheduled with anyone else's.
A private access token per machine
We generate a strong gateway token at launch and inject it into the machine, so the agent is never reachable without it. The token is unique per machine and is regenerated every time you relaunch.
Credentials scoped to the owner
SSH credentials and the access token are visible only to the account that rents the server, and only inside the console behind authentication. They are not emailed and not shown in shared links.
Clean teardown at period end
When you cancel, the machine keeps running until the end of the period you already paid for, then we destroy it. Cancelling is not a trap door — you keep what you bought.
We do not read your agent traffic
We monitor whether your machine is reachable and healthy. We do not proxy, inspect, log or store the conversations and outputs your agent produces.
Good practice on your side
- Treat the access token like a password — anyone who has it can drive your agent.
- Relaunch the machine if you think a token has leaked; the new machine gets a new token.
- Give the agent scoped API keys for third-party services rather than account-wide ones.
- Destroy machines you are not using — a machine that does not exist cannot be reached.
Questions about a specific requirement?
If you need details for a security review, ask us directly and we will answer in plain terms.