Run AI agents under control.

Not in the agent. The process holds the literal string safepod-proxy-managed and nothing else — so "print your environment" prints a placeholder, and an agent persuaded to upload its own configuration uploads a placeholder too. The real key is attached outside the sandbox, on the way out, by a component the agent cannot read, reach or reconfigure. Taking the key is not something a clever prompt can do; it needs the platform itself to be compromised.

No, and anyone who tells you otherwise is selling something. Keeping the credential out of the sandbox stops a key being stolen; it does not stop a hijacked agent making a legitimate-looking request with the permissions you granted it. What SafePod bounds is the blast radius. A fully compromised agent still cannot take the key, leave its sandbox, read another agent's files, reach your machine, call an action you did not grant, or call one that does not exist in the catalogue — and whatever it does try is on the record.

A pod each, not a folder each. Every running agent gets its own kernel-level sandbox (gVisor), its own filesystem and its own network policy, and the workspace disk is attached per agent rather than shared. There is no host to escape onto, no shared home directory, and no sibling process holding a credential worth reading. An agent that deletes everything it can see has deleted its own workspace.

Two things, and the second is the one that matters. First, grants: an action is handed to one named agent at a time, typed at the level of search versus create rather than "access to your mailbox". Second, the catalogue: an agent can only invoke actions SafePod implements, so capabilities outside it are not restricted — they are absent. SafePod ships no send-mail code path at all, which is why an agent asking to send mail is refused by the absence of the feature rather than by a policy that could be misconfigured.

One activity record across every agent, not one transcript per tab: what ran, against what, and how it ended — including the calls a grant refused, which are usually the interesting ones. Message bodies are deliberately not kept; connector activity records a hash of the input, so the record proves what happened without becoming a second copy of your data.

No, and this is deliberate. Runtimes are interchangeable on SafePod, and a stopped agent can be switched from one to the other while keeping the same workspace and the same files. For models, bring your own LLM provider — Anthropic, OpenAI, DeepSeek, GLM, Kimi, Qianwen, MiniMax, OpenRouter, or an OpenAI-compatible model endpoint of your own. SafePod calls the real model to confirm a provider works before saving it, rather than taking the configuration on trust. The platform is the product; the agent is not.

That is what it is for. An agent lives on SafePod, not in your browser and not on your machine, so closing the tab changes nothing — and neither does shutting your laptop, losing your connection, or going to sleep. A job that takes days takes days, and you come back to the result and to the record of how it got there. An agent that runs while nobody is watching is exactly why the two things above it on this page exist: it can only touch what you granted, and everything it did is written down.