Security and your data
How Rootsy keeps computers apart, what its systems and staff can reach, where your files and backups live, and what you secure yourself.
A machine of your own
Each computer is a Linux virtual machine with its own disk. Computers don’t share files or processes, whether they’re yours or another customer’s. See Security.
One way in
Requests from the internet reach a computer only through Rootsy’s edge, which handles HTTPS. There’s no SSH and no other inbound port. Your workspace and your apps sit on separate hostnames, so a page your app serves never shares an origin with your terminal. Opening a workspace uses a short-lived token for that one computer.
What Rootsy can reach
Rootsy’s systems can run commands on a computer as root. They use that to set it up, back it up, restore it and reset it. Nothing on the disk is encrypted with a key only you hold.
For metering, each computer reports its CPU, memory and disk use. The reports carry no file names, process names or traffic.
Staff look inside a computer only if you ask for help, only as far as needed, or where the law requires it. The privacy policy says so.
Rootsy doesn’t read or log your Claude token or your prompts. Claude Code stores both on the computer’s disk, so they’re in backups like any other file.
Where your data lives
Your files live on your computer’s disk. Its backups are kept with it. Deleting a computer deletes its files and every backup, and staff can’t bring them back. See Your data.
The privacy policy lists the service providers that store or handle your data.
What you secure
Rootsy puts no login in front of your apps. Anything a computer serves is open to anyone with the URL until you add one. See Protect an app.
Rootsy has no secrets manager. Keys you put on a computer are ordinary files. Your coding agent, every member of the organization and any MCP client you connect can read them. They go into every backup too. Anything under ~/sites/default is served to the internet as is, dotfiles included, so keep keys out of it.
Rootsy doesn’t update what you install. Keep your packages and dependencies current. See Security.
To report a security problem, write to support@rootsy.io. Security says what to include.