# Security

> How Rootsy is put together, what it protects, what you must protect on your computer and in your apps, what Rootsy's systems can reach, and how to report a security problem.

This page covers Rootsy's security model. Rootsy secures the machines your work runs on, the network path to them and the sign-in that reaches them. What you install, store and serve on a computer is yours to secure. You have root on it, and Rootsy doesn't patch or inspect what you put there.

## How Rootsy is put together

Rootsy has three parts.

A computer is a Linux virtual machine with its own disk. Computers don't share a filesystem or processes with each other, whether they're yours or another customer's.

The control plane is the app at `app.rootsy.io`. It handles sign-in, billing, organizations and the dashboard. It keeps its own database of accounts and computers. It creates, configures, backs up, restores, resets and deletes computers. The MCP server at `https://app.rootsy.io/mcp` is part of it.

The edge is the routing layer every request from a browser or a visitor passes through on its way to a computer. It terminates HTTPS, holds the certificates for custom domains and forwards each request to the right computer. The service providers Rootsy uses are listed in the [privacy policy](https://rootsy.io/privacy/).

## Hostnames

| Hostname | What it serves |
|---|---|
| `app.rootsy.io` | The dashboard and the control plane. Not tied to any one computer. |
| `<name>.rootsy.io` | The workspace's connection to one computer: the Terminal, Editor, Files window and preview events |
| `<name>.rtsy.dev` | The computer's address. Your apps. |
| Your custom domains | Your apps, the same as the address. Each points at `connect.rtsy.dev` with a CNAME. |

Creating a computer needs no DNS change. The edge looks up which computer each hostname belongs to.

## What Rootsy secures

### Separate hostnames for the workspace and your apps

The edge enforces the split before a request reaches the computer. On the workspace hostname it serves only the platform's own paths, which start with `/_iw/`. On the address and custom domains it refuses those paths. It checks the path as sent and the path after decoding, so an encoded form such as `/%5Fiw/terminal` can't cross over.

A page you serve, or one an attacker plants in your app, never shares an origin with your workspace. The Terminal and Editor won't load inside a frame on any site other than `app.rootsy.io`. Responses on the platform's paths carry `Cache-Control: private, no-store`, so the edge never caches them.

### Short-lived tokens and scoped cookies

You sign in to `app.rootsy.io` with your Rootsy account. The control plane checks on every request that the computer you ask about belongs to your personal account or an organization you're a member of.

When you open a computer's workspace, the dashboard asks the control plane for an access token. The control plane gives one only if the computer is yours to reach and the account isn't suspended. The token names one computer, is signed with a secret unique to that computer, and expires after 60 seconds. The control plane stores each computer's secret encrypted with AES-256-GCM.

The computer checks the token and sets its own session cookie. The cookie is `HttpOnly`, `Secure` and `SameSite=Lax`. It's limited to the `/_iw` path on that computer's workspace hostname, and it lasts 24 hours. Your apps run on other hostnames, so they never receive it.

### HTTPS and what the internet can reach

The edge terminates HTTPS for the address and your custom domains. Rootsy issues and manages their certificates. The edge connects onward to the computer over HTTPS as well.

Requests from the internet reach a computer only through the edge. They arrive at the platform's web server on port 8080, which hands app traffic to your nginx on port 8090. There's no SSH and no other inbound port. A database or a service on port 3000 can't be reached from outside unless you proxy it through nginx.

The edge presents a secret unique to each computer when it connects. A request that reaches a computer without that secret gets 403 before it reaches the Terminal, the Editor or your app. The platform removes the secret before passing a request on, so your app never sees it.

### Your processes and the platform's

Your processes run in their own group, apart from the platform's services. That group is throttled once it uses 80% of the computer's memory, and it can hold at most 4,096 tasks. The platform's services get first claim on CPU and disk. A runaway program slows your own work, and the Terminal and Editor stay reachable so you can stop it.

### Outbound traffic

Outbound connections are open, except TCP port 25 (SMTP). It's blocked for the computer and for Docker containers on it, over IPv4 and IPv6. [Your computer](https://rootsy.io/docs/reference/computer.md) covers how to send email instead.

### Signed scheduled requests

Every request a schedule sends carries an HMAC-SHA256 signature. It covers the computer, the schedule, the occurrence, the signing time, the method, the path, the `Host` and a hash of the body. Its key is unique to the computer. The verifier on the computer rejects requests signed more than 120 seconds ago. [Scheduled tasks](https://rootsy.io/docs/reference/scheduled-tasks.md) shows how your endpoint checks it.

### MCP access

An MCP client connects through an OAuth sign-in with your Rootsy account and a consent screen. The client gets one permission, `rootsy:access`, which lets it act as you. Rootsy checks each token's issuer, audience and expiry on every request. Every call also rechecks whether you've paused MCP access and which accounts you belong to. Leaving an organization or pausing access takes effect on the next call. See [Connect with MCP](https://rootsy.io/docs/reference/mcp.md).

### Your Claude account

Claude Code signs in between your browser and claude.ai. Your prompts go from the computer to Anthropic. The control plane never receives your Claude token or your prompts. What you type in the Terminal passes through the edge on its way to the computer, and the edge doesn't log it. The control plane learns only whether Claude Code on a computer is signed in, as a yes or no.

Claude Code stores its sign-in token and session history in `~/.claude` on the computer's disk. They're in backups like any other file, and Reset keeps them.

### Rate limits

Rootsy limits how many computers an account can create in a rolling 24 hours. It limits invitations to 10 an hour, per member, for each organization. It limits running a schedule by hand to once a minute and 10 times an hour. [Limits](https://rootsy.io/docs/reference/limits.md) lists the rest.

### Backups

Once a day, Rootsy backs up each computer that has been in use since its previous backup. You can make your own before a risky change. A backup restores the computer's disk to an earlier state, which is how you recover from a bad change or a compromised app. Backups don't include Docker images, containers or volumes, and a restore doesn't roll them back. Backups live with their computer, so deleting a computer deletes its backups. See [Backups and Reset](https://rootsy.io/docs/reference/backups-and-reset.md).

## What you're responsible for

### Putting a login in front of your apps

Everything a computer serves at its address and custom domains is reachable by anyone who has the URL until you add a login. Rootsy puts no login in front of apps. Signing in to Rootsy protects only the workspace and dashboard. An admin page, a staging copy or a tool that's only for you needs a password or sign-in of its own. An unlisted address won't keep it private. [Protect an app](https://rootsy.io/docs/reference/protect-an-app.md) shows both ways.

### Secrets you store on the computer

Rootsy has no secrets manager. API keys, tokens and `.env` files you put on a computer are ordinary files on its disk. That means:

- anything running as `dev` can read them, including the coding agent, your apps and every package they install, and `dev` has `sudo`
- they're copied into every backup of the computer
- every member of the organization that owns the computer can read them
- an MCP client you connect can read them

Keep secrets out of any directory nginx serves. The default server serves every file under `~/sites/default`, dotfiles included, so a `.env` saved there is downloadable at `https://<name>.rtsy.dev/.env`. Keep them out of git repositories you push. Prefer keys you can scope and revoke. When one leaks, revoke it with the service that issued it.

### Who you let in

Every member of an organization has full access to every computer in it: the terminal, the files, deleting the computer, and removing other members. An invitation link works for whoever opens it while signed in to Rootsy. Send it only to the person it's for, and don't post it anywhere shared. Invite only people you'd trust with everything in the organization. See [Organizations](https://rootsy.io/docs/reference/organizations.md).

### What the coding agent reads

The coding agent runs as `dev` with passwordless `sudo`, so it can do anything on the computer. Text it reads can steer it: a web page, a GitHub issue, a README in a downloaded package, a file someone sent you. Review what it does, especially when it acts on content from other people. Don't paste instructions you got from someone you don't trust.

### The MCP clients you connect

A client you connect can run any command as `dev`, read and write files, and create, reset and delete computers. It can do that in your personal account and in each of your organizations. Connect only clients you trust. Remove a connection from the client when you stop using it. To cut off every connection at once, including ones you've forgotten, choose **Pause MCP access** under **MCP access** on the **Account** page. Open it with **Manage account** in the account menu, or **Settings** in the sidebar while you're in your personal account. If you think a token has leaked, leave access paused.

### Keeping software up to date

Rootsy doesn't update the software you install. Packages from `apt`, your apps' npm dependencies, Docker images and anything else you add stay at the version you installed until you upgrade them:

```sh
sudo apt update && sudo apt upgrade
```

In each app's directory, `npm audit` lists dependencies with known vulnerabilities.

### Data your apps collect

Whatever your apps collect from visitors is yours to protect and yours to disclose. That includes accounts, form submissions, uploads and payment details. Rootsy adds nothing to your apps' pages. It adds no analytics, no cookie banner and no privacy notice.

## What Rootsy's systems and staff can reach

To operate a computer, the control plane can start, wake and restart it, write its platform configuration, and run commands on it as root. It uses that access to set computers up, take, check and restore backups, and reset them. Commands you send through MCP run as `dev`. Nothing on a computer is encrypted with a key only you hold, so everything on its disk is within reach of those systems.

Each computer reports three numbers to the control plane for metering: CPU use as a percentage, memory in use, and disk space used. The reports carry no process names, file names or traffic contents. [Billing](https://rootsy.io/docs/reference/billing.md) explains how those numbers turn into Runtime Credits.

Rootsy's operators can suspend an account or cut off a computer's outbound traffic when it's used for abuse. A suspended account can't open its workspaces. Its apps go offline, every computer in it loses outbound network access, and Rootsy emails the account about it.

The [privacy policy](https://rootsy.io/privacy/) says when Rootsy staff look at the contents of a computer: only if you ask for help, only as far as needed, or where the law requires it.

## If you think a computer is compromised

1. If an MCP client might be involved, choose **Pause MCP access** in the app.
2. Revoke every key and token that was on the computer with the service that issued it. Start with the ones that can spend money or reach other systems.
3. Restore a backup from before the problem started. Reset alone keeps everything under `/home`, `/root` and `/srv`, so it doesn't remove anything planted there. Neither touches Docker images, containers or volumes, so remove and rebuild any you don't trust.
4. Put new keys on the computer only after the restore.
5. Check your organization's member list and remove anyone who shouldn't be there.

## Report a security problem

To report a vulnerability in Rootsy, or a computer or app on Rootsy that's being used for abuse, write to support@rootsy.io. Include the hostname or computer involved, what you did and what you saw. Don't include working secrets or other people's data in the email.

---
Page: https://rootsy.io/docs/reference/security/ · Updated: 2026-10-21 · All docs: https://rootsy.io/llms.txt