Dory is in development. The invite-only beta has not opened yet; prices and limits are planned and may change.
Doryby ComputeEngines
Request beta access

Security model and what we can see

Each computer is its own virtual machine, and you have root inside it. Computers cannot reach each other or our private services. All computers run in one location in New Jersey, on hardware we operate. Capacity is shared and may occasionally be limited; limits we apply to protect the platform are never billed. There is no service-level agreement. We hold no audit certification. See Honest limits.

Data access and credentials

Data API traffic is decrypted at our gateway. That includes file transfers, screenshots, terminal and process output, and browser control. Access tokens are short-lived and scoped, but a live gateway compromise would remain a risk to in-flight customer data. Do not treat a computer as a place to put credentials you cannot rotate.

You have root inside the VM and can stop or modify the in-guest agent. Doing so makes data API calls return 502 agent_unreachable while SSH stays reachable. It does not stop compute billing, pause the computer or create a maintenance credit; use an explicit lifecycle action when the computer should no longer run. Keep API keys outside the computer; agents normally need only narrow computer-scoped access.

Customer content (command output, files, screenshots and command lines) is not logged. This is distinct from output you intentionally ask us to retain through the process API: process output has its own one-hour retention and byte limits. Keep your own copies of important files outside our infrastructure. Snapshots and private images are not backups.

Sign-in and keys

The console requires a password and a second factor (an authenticator app or a passkey with user verification). API keys are scoped, can be restricted to specific computers, labels, source networks and a cost limit, and can expire; see Authentication and API keys and Keys and limits for agents. Data API access uses short-lived, computer-scoped access tokens.

Revocation

Key, token and session revocation takes effect within five seconds. Suspension denies use while active. Lifting a suspension does not revive permanently revoked keys, tokens, previews, share links or hooks, and does not start a computer. Obtain new authority where needed and use an explicit start or resume.

We may preserve records for a valid legal hold and comply with mandatory reporting obligations. A legal hold overrides otherwise valid computer deletion, snapshot restore or deletion and private-image deletion when they would destroy held data. These requests return 409 invalid_state with retryable: false, no destructive operation is accepted, and the refusal leaves the billing state unchanged. Pause and stop remain available where the lifecycle permits. See Lifecycle, Snapshots and private images and Close your account.

To report abuse, see Report abuse. Terms and policies, including how long operational records are kept, will be published before the beta opens.

Dory is in development; these pages describe the planned service and may change. Questions: support@computeengines.com.