Security and data · Ephemeral docs

How a run is isolated, how credentials are kept away from agents, what is stored and for how long, and how to report a problem. This page describes the hosted service at ephemer.al. A self-hosted installation runs the same engine on your own infrastructure, so retention and providers are yours to choose; see self-hosting.

Isolation

Boundary	How it works
One machine per run	Every run starts its own microVM from a fixed worker image. When the run ends, the machine is destroyed, and the run's record shows when that was confirmed.
Lifetime	The machine lives at most the run's timeout plus a minute (the timeout is 1 to 3,600 seconds). Cancelling or timing out a run destroys it.
Network	A worker has no direct internet access. Everything outside goes through a connection or, if the run has it, web access, both checked by Ephemeral.
Shell	On by default. With `shell` set to `false` the agent can only read its files and use the tools you grant. With it on, the agent can run commands and write files in its scratch directory, inside a machine that has no network and none of your credentials.
Nothing carries over	The scratch directory disappears with the machine. Files you mount are read-only. No machine, file or process is shared between runs, or between organizations.

Credentials

No credential enters the machine. Model calls and connection requests go through Ephemeral with a token that works only for that run, only while it is running. The worker is told each connection's name, type, tools and instructions, never its URL or secrets.
Allowed methods and tools. Ephemeral checks every call against the run's grant: allowed_methods for HTTP connections, allowed_tools for MCP servers. A run can narrow a saved connection but never widen it.
Removed from responses. Ephemeral removes the exact credential values of the run's connections from responses, events and output before they reach the agent or the record. This catches the values themselves, not transformed copies of them.
Encrypted at rest. Run definitions, including inline credentials, and saved connection settings, including OAuth tokens, are encrypted before they are stored. API keys and session tokens are stored only as hashes.
Apps you authorize. An application that signs in with OAuth gets a one-hour access token and a rotating refresh token for one organization, never your password. Both are stored only as hashes, and you can review and revoke every authorized app on your account page.

Secrets you write into a task are stored with the run

A prompt, input or inline file is kept with the run, and an agent with web access can send what it reads anywhere on the public web. Keep secrets in a connection, and give runs that handle private data a web allowlist.

Web access

Off unless the run asks for it. Requests are sent by Ephemeral, not by the machine, as EphemeralBot, with a request ID and published addresses so site owners can recognise and block them, and it follows robots.txt rules addressed to it.
Only public addresses are reachable. Private and reserved addresses are refused, redirects are checked again, and an allowlist limits a run to the sites you name.
Each request is checked for attacks, spam and data being smuggled out, and every run has a request limit. See web access for the full rules.

Budgets are a hard limit

Before a run starts, Ephemeral reserves its whole budget from your credits. A model call or web request that could take the run past the budget is refused before it is sent, and the unused reservation is released afterwards. A run cannot spend more than its max_cost_micros. See budgets and billing.

What is stored, and for how long

Data	Kept
Runs: definition, output, events	30 days after the run ends, then deleted. A run is kept longer only while its billing, callback delivery or machine cleanup is still pending.
Zero-data-retention runs	Run ID, organization, status, timestamps, cost and usage, and a generic error category. Events are deleted a few minutes after the run ends. The output is returned once and deleted after at most an hour. The definition is not kept.
Uploaded files	Until you delete them. A deleted or replaced file can take up to 30 days to be removed from storage.
Backups	30 days. A run deleted from the service can remain in backups for up to 30 more days. Zero-data-retention events and outputs are never in a backup.
Account and billing records	As the Privacy Policy describes. Sign-ups that never confirm their email address are deleted after seven days.

Zero data retention is a setting on a run or a workflow: zero_data_retention: true. On the hosted service these runs cost 10% more, which counts toward the budget. See runs.

Data is stored in Japan, and is encrypted in transit and at rest.

Model providers

Model calls are sent, with the content the agent includes in them, to the provider that serves the model you choose.

A zero-data-retention run uses only endpoints that neither keep nor train on the request. If a model has none, the run is refused with 400 before anything is reserved. Web safety checks and searches for every run use endpoints that do not collect data.
Other runs fall under the model provider's own data policy. Use zero data retention for sensitive work.

We use a small number of service providers to host and protect the service, take payments (Stripe), send email and run models. Each receives only what its job needs. The Privacy Policy describes them.

Our access

Ephemeral staff access customer records only to give support, keep the service secure and handle billing. Staff access needs strong authentication and is logged, and zero-data-retention runs leave no content to look at.

Account security

Area	How it works
Email verification	An account signs in only after you open the link emailed to you.
Bots and guessing	Sign-up and password recovery are protected by a captcha, repeated failed sign-ins require one, and authentication requests are rate-limited.
Passwords	At least 12 characters, stored only as hashes. Reset links work once and expire after 30 minutes. Resetting a password signs out every session; changing it signs out the others.
Sessions	Kept in a secure, HttpOnly cookie. Signing out ends the session immediately.
API keys	Shown once, revocable at once, with the role `member` or `admin`. An admin key cannot manage members, keys or billing. See roles and keys.

Reporting a problem

Report a vulnerability through Support in the dashboard: open a request and put "Security" in the subject. Describe how to reproduce it, and do not include secrets or other customers' data. To report abuse by EphemeralBot, use the form on the EphemeralBot page; you need no account.

What this page does not claim

Ephemeral does not claim any certification or audit. This page describes how the service is built and run.