Security · cmdz

Isolation

Four layers, and where each one stops

Your app runs in its own kernel

Every workload is a Kata Containers micro-VM: a real virtual machine started by the same Kubernetes machinery as an ordinary pod, with its own kernel and its own memory.

A container escape on a shared-kernel platform reaches the host. Here it reaches a kernel that belongs to one customer and nothing else. Fly.io achieves the same thing with Firecracker — this is not an exclusive claim, and we are not going to make it sound like one.

Network segmentation per project

Workloads can reach their own services and the internet, and nothing else. There is no flat internal network, and there is no path from one customer's app to another's database, however the connection string is constructed.

Encrypted at rest, unlocked on boot

Full-disk encryption on every node, with keys released by a network-bound unlock service rather than stored on the machine. A disk that leaves the rack is a brick.

Secrets are never in the repository

Environment variables and secrets live encrypted in the platform. cmdz env pull writes names, never values — including for an agent, which can see that a DATABASE_URL exists but never what it is.

Authentication

There is no password to steal.

Logging in is a passkey and nothing else. No password, no username, no email with a code, no authenticator app. Phishing a passkey is not a matter of a convincing email — the credential is bound to the origin and simply will not present itself to a lookalike domain.

We do not support passwords as a fallback, and we will not add one on request. A fallback that is weaker than the primary method is the security level of the account.

Two boundaries sit behind that. The platform lives on cmdz.com and customer apps live on cmdz.app — a separate domain, deliberately, so a customer app can never see a platform session cookie or a platform passkey. And the admin interface additionally requires an IP allowlist and a fresh passkey confirmation for anything that touches a customer.

Passkeys only, no password fallback, ever
Step-up confirmation for destructive and financial actions
Separate domain for customer apps, so cookie and passkey scopes cannot overlap
Sessions are revocable per device, and revocation is immediate
Recovery through a second passkey or a signed recovery code you store yourself

the audit trail

  09:14  ronald        deployed web           #412
  09:31  claude-code   cmdz_scale_app 2→3     agent
  09:31  claude-code   cmdz_get_metrics       agent
  10:02  ronald        raised limit €20 → €35
  10:44  claude-code   cmdz_create_service    agent
  10:44  claude-code   cap_exceeded (refused)  agent
  11:20  ronald        rolled back web  #412→#411

  every line: actor · tool · request id · undo

Agents

The security case for handing over the keys

An agent with platform access is a new class of risk and pretending otherwise would be dishonest. Here is what actually contains it.

A financial ceiling it cannot move

The blast radius of a compromised agent is bounded by a number you set, because raising that number is not something any token can do.

A daily action budget

Separate from the limit and much smaller. An agent in a loop stops at the budget long before the ceiling, and you get told.

A five-second kill switch

One button revokes every agent token in the organisation. It is the most prominent control on the agents screen, on purpose.

Untrusted content is marked as such

Log lines, error text, repository content and variable names that an agent reads are wrapped and labelled untrusted, so a prompt injection planted in a log is data rather than an instruction.

Confirmation the agent cannot forge

Destructive operations need a token that only your interface can produce. The agent has to come back to you.

Five permanent blocks

Raising the limit, changing payment details, dissolving the organisation, transferring ownership, managing members. No scope, no profile, no tool.

The full agent safety model

GDPR

The paperwork, downloadable without a conversation.

The data processing agreement, the privacy policy, the terms and the acceptable use policy are on this site as ordinary pages. You can read them, copy them and send them to your own counsel without giving us an email address first.

Data residency follows the region you pick: choose an EU region and your data, its backups and its logs stay in the EEA. The subprocessor list names the supplier and the data center per region, and it changes with notice rather than quietly.

We are not SOC 2 attested and we do not have a compliance department. If your procurement process requires one, we are honestly not the right platform for you yet, and we would rather say that on this page than three meetings in.

Data processing agreement under GDPR article 28, downloadable here
Subprocessors listed per region, with changes announced in advance
Breach notification within the statutory window, to you and where required to the regulator
Export everything at any time, in standard formats
Deletion on termination, with the retention windows written down

Read the data processing agreement

Disclosure

If you find something, tell us.

Email [email protected]. We acknowledge within one working day and we will tell you what we found and when we fixed it. We do not have a bug bounty programme and we are not going to pretend we do; what we do have is someone who reads that mailbox and can reach the servers.

We ask for the ordinary things: give us a reasonable window before publishing, do not access data that is not yours, and do not run anything that degrades the service for other customers. In return we will not threaten you, and we will credit you if you want to be credited.

Read the acceptable use policy

security.txt

Contact: mailto:[email protected]
Policy: https://www.cmdz.com/security
Preferred-Languages: en, nl

# Acknowledged within one working day.
# No bounty programme. A real person, though.

Read the agreements before you sign up, not after.

All four legal documents are ordinary pages on this site. No form, no sales call, no gated PDF.

Data processing agreement Privacy policy