Security
Aether asks for two sensitive things: access to your repositories and the credentials of your agent provider account. This page describes precisely how both are protected: what is encrypted, what is isolated, what is retained, and who can see what.
It describes the system as it runs today. We would rather show you the architecture than imply a compliance posture we have not earned yet.
Encryption at rest
Provider credentials, API keys, environment variables, secret files, integration tokens, and skills are encrypted with AES-256-GCM before they are stored. Encryption keys are derived per user or per project, never shared between accounts.
Secrets are decrypted only when your task starts, directly into that task's isolated VM, as files readable only inside it.
Encryption in transit
Every public endpoint forces HTTPS. WebSocket connections require an authenticated token, and each devbox authenticates to the control plane with its own per-workspace token, verified in constant time.
Isolation
Each task runs in its own Firecracker microVM with its own volume, and a devbox is never reused for another task or another user. The warm pools and environment caches that make boots fast are scoped to your project; nothing warm is shared across accounts.
Devbox lifecycle
A devbox suspends when idle and bills nothing while suspended. The machine and its volume are destroyed when the task's pull request merges or closes, or after 48 hours of inactivity.
What survives the machine: the task transcript, the agent's saved state, and the branches pushed to your GitHub. That is what lets you reopen a task later and continue where it stopped.
Preview links
Every live port preview sits behind a random 128-bit token carried in the URL and compared in constant time. A preview link lives exactly as long as its workspace and dies with it.
GitHub access
A devbox never holds a long-lived GitHub token. Tokens are minted on demand, scoped to the single repository of your project, with write access limited to repository contents and workflow files and read-only access to pull requests, issues, and checks.
Your code and your model provider
The agent calls your model provider directly with your credential. Aether never proxies, meters, or resells model access, and we do not train on your code.
Aether does store task transcripts and tool outputs: that history is what renders your workspace, powers review, and lets a task resume.
Who can access what
Aether is a small company and does not pretend otherwise. Administrative tooling runs from a single operator machine, records every action in an append-only audit log, and is structurally unable to decrypt user credentials. Founder-level access to production infrastructure exists, as it does at any company this size; today that set of people is exactly one.
Data deletion
There is no self-serve account deletion yet. Email security@runaether.dev from your account email and we will delete your account, its tasks, and its stored credentials.
What we do not have yet
No SOC 2 or ISO certification yet, no SSO or team accounts, and a single region (San Jose). When one of these changes, this page changes.
Reporting a vulnerability
Reports go straight to the founder and real findings get fixed. A machine-readable pointer lives at /.well-known/security.txt.