Your agent gets sudo. Your logins stay in their project
Subscription refresh tokens stay encrypted on our server, and each terminal gets an access token we renew. Service keys stay in Sallyport. Every project keeps its own logins and configs. Our bet on a shared kernel gets you full Docker at $39.
From $39 a month · Docker and sudo included · Cancel from the dashboard any time
Your subscriptions and keys
Connect Claude and ChatGPT once. What mints new tokens stays with us; your terminals get the access token their CLI needs, and our server keeps it fresh.
- Tokens
Refresh tokens never reach your Compute
Your Claude and ChatGPT refresh tokens stay in our database, encrypted with AES-256-GCM. Each launch on a subscription gets a file with one access token, renewed on schedule. An agent running with sudo holds nothing that can mint a new one.
- API keys
An API key stays in the launch that uses it
A key you connect is written only into the launches that run on it, inside their project, readable by your user alone. Terminals of your other projects never see it.
- Accounts
Disconnect and it is gone
Remove an account in the dashboard and we delete its tokens from our server at once and from your terminals. Sign out at OpenAI or Anthropic to end the session on their side too.
- Prompts
Your prompts go straight to the model
Model traffic leaves your terminal for your provider directly, Anthropic, OpenAI or whichever key you run on, and never passes through detachbox.
- Vault
Company keys stay off your Compute
With Vault, each project gets its own Sallyport agent, created with no access. Your agents call Stripe or GitHub through it, and the service keys stay in Sallyport.
Your Compute
Run an agent with sudo and approvals off: it reaches its own terminal, its project and that project's home folder, and stops there.
- Bet
Our bet: one kernel, many customers
Every terminal is an unprivileged system container on a shared kernel, with nesting on so Docker runs inside, and its own range of user IDs. Your account disk mounts only into your own terminals, so every customer is sealed off. The shared kernel is our bet, and it gets you full Docker at $39.
- Projects
One project's logins stay in that project
Every project has its own home folder. A project terminal mounts only its own code and that home, so logins, configs, agent hooks and caches never cross between projects, and a repo you clone cannot plant a line in the .bashrc your other projects run.
- Agents
Approvals off, one project in reach
Agent CLIs run with permission prompts off, so the work never stops to wait for your yes. Whatever an agent breaks in the system stays in its terminal and goes when you end or restart it.
- Limits
Nobody else’s build eats your CPU
Your size sets a hard cap on CPU and memory for all your terminals together, and each terminal has its own process limit. Docker runs at the lowest priority, so the shell and the agent stay quick during a build. A runaway build next door stays next door.
- Image
A tested system every 6 hours
The base system is rebuilt every 6 hours with the latest Claude Code, Codex and OpenCode, and goes live only after a smoke test. A build that fails leaves the last good one in place.
- Reboots
Terminals come back after a reboot
After a node reboot your terminals return by themselves, with files, packages and Docker images in place. Running processes stop, and each agent comes back on its last conversation by itself, waiting for your next word.
Your network
Your Compute reaches the internet; only you and the people you send a link reach your Compute.
- Network
Walled off from other customers
Each terminal reaches the public internet at 50 to 1,000 Mbit/s by size. Private networks, our servers, other customers and outbound mail on port 25 are blocked for every Compute.
- On-premise
Your LAN stays shut until you open it
With Enterprise on-premise, terminals on your server reach none of your private networks until your admin opens one on that server. The node only dials out, and detachbox cannot open a network from its side.
- Previews
Previews on their own domain
Your dev servers answer on detachbox.dev, a separate domain from detachbox.com, private to you until you make a port public. Dashboard cookies never reach them, and a private preview refuses another site's frames, fetches and WebSockets.
- Files
Share a file, keep your .env to yourself
A share link opens one file for 15 minutes to 7 days and counts every open. A report you open as a page reaches only the files in its own folder, never .env, .git or any other dot file.
- Access
One way in: your signed-in dashboard
Every terminal opens through the dashboard over an encrypted WebSocket, with a ticket for that one terminal that expires in 60 seconds.
Your account
Your account takes passkeys, signs every request, shows every signed-in device and logs every change.
- Sign-in
Passkeys, codes and Google
Sign in with a passkey (Face ID, Touch ID, Windows Hello or a security key), Google, or email and password with an authenticator code on top. Adding or removing a passkey or code asks you to sign in again and sends you an email.
- Requests
A stolen session token opens nothing
Every request from your dashboard is signed by a key your browser created and cannot export. A session token copied from a log, a proxy or a browser extension fails without it.
- Sessions
Every device you are signed in on
Settings lists your signed-in devices with their location and browser. Sign out the others in one click. Session tokens are kept only as hashes.
- Activity
A log of every change
The log records every size change, project, saved launch, public port and shared file link on your account, with its exact time.
- Payments
Cards stay with Stripe
Card entry and invoices run in Stripe's own checkout and billing portal; card numbers never touch our servers.
Found something?
Write to abuse@detachbox.com about abuse coming from a Compute, and to support@detachbox.com about the security of the service.
Questions about this
Can you see what runs on my Compute?
Not your files. We see CPU, memory, disk and traffic per Compute, and use them to keep the node healthy. We open a Compute when you ask for help, for a security incident or abuse, or by law.
Is it safe to connect my Claude or Codex subscription?
Yes. Your refresh token stays encrypted on our server and never reaches your Compute. The agent gets an access token for its CLI. Disconnect the account and we delete its tokens from our server and from your terminals.
Where do my API keys live?
In the launch that uses them, inside its project, readable by your user only. Terminals of your other projects never see them. A subscription works differently: its refresh token never leaves our server.
What if an agent goes rogue on my Compute?
It is fenced into its terminal with its own project and that project's home folder; private networks, other customers and outbound mail are blocked. End the terminal and its whole system goes with it; the next one starts clean.
Why a shared kernel instead of a VM per customer?
A VM per customer would cost several times more for the same CPU and memory. The shared kernel is how full Docker costs $39. Unprivileged containers, a separate range of user IDs for every terminal and blocked internal networks keep customers apart on it.
Your agent gets sudo; your refresh tokens stay with us
Pick a size, connect your subscription or key and let the agent work.
Get my ComputeYour first overnight run works, or your money back · Cancel from the dashboard; it runs to the end of the paid month