Security

This page describes how Tanzanite is built to protect your projects and your account. It is written from the system as it actually runs today — not a roadmap — and every claim below is something you can hold us to.

To report a vulnerability, email [email protected]. Our disclosure policy, scope and response commitments are at tanzanite.ai/security; the machine-readable contact is /.well-known/security.txt.

Where agents run

Cloud agents execute tools in a sandbox that is isolated from other users and from our own control plane:

• Every cloud sandbox is a dedicated Kubernetes pod under gVisor, a user-space kernel that separates the workload from the host kernel. Pods run as a non-root user.
• The sandbox holds no credentials for our systems: no database access, no provider API keys, no other user’s data. The only credential inside it is a short-lived git token scoped to that one project’s repository. A compromised sandbox can reach exactly that repository and nothing else.
• Every call that needs a secret (an LLM provider, a connected service, a payment) is made by our control plane, and only the result is handed to the sandbox.
• Scripts the agent runs inside a sandbox have no ambient network unless the tool that launched them explicitly allows it; outbound web access from the agent’s own tools goes through a request guard that blocks private and internal address ranges.
• A sandbox is torn down when its session ends. Nothing persists in it between sessions except through the project’s git repository.

When the desktop app is open, a project can instead run its tools on your own machine, and a project can be marked local-private so that its files never leave your device at all — see How cloud agents run.

Your data

• One writer. Only our control-plane service writes to the database; the database’s own access rules deny every direct read or write. Browsers, desktop apps and sandboxes go through authenticated API routes with per-user authorization on every request.
• Encryption at rest. All stored data is encrypted at rest by Google Cloud. Two classes of record carry an additional layer of application-level envelope encryption with keys held in Cloud KMS, bound to the owning user so a record cannot be replayed into another account: saved browser logins, and project secrets (which the agent can only ever reference, never read back).
• Encryption in transit. All traffic is HTTPS; our domains enforce HSTS with preload.
• Media handling. Uploaded media that needs parsing is processed only inside a sandbox, never on the control plane.
• Model providers don’t train on your data. Every request we send to a model through OpenRouter is flagged to route only to providers whose policy forbids training on, or retaining for training, what you send; providers without that guarantee are excluded. (Providers may hold prompts briefly for abuse monitoring under their own terms.)
• Data residency. Production runs in Google Cloud, region us-central1 (Iowa, USA). Our vendors and what each processes are listed on the subprocessors page.

Your account

• Sign-in by email/password or Google, with bot protection on signup.
• Per-device sessions you can review and revoke individually from Account settings; changing your password revokes every other session.
• Security notifications by email for new-device sign-ins, password and email changes, and account deletion requests.
• Account deletion is a 30-day soft-delete you can cancel, followed by an enforced purge across every store; you can export your data at any time before that.

Coming

We are transparent about what is not yet in place:

• Two-factor authentication (TOTP) is planned but not yet available.
• Per-project encryption keys for plan and message content (on top of Google’s disk encryption) are designed and scheduled.

Reporting a vulnerability

Email [email protected] with enough detail to reproduce. We acknowledge reports within 3 business days and aim to fix or give you a status update within 30 days. Good-faith research that follows the policy at tanzanite.ai/security will not be met with legal action. We do not run a paid bounty program at this time.