Security
What we isolate, what we log, what we don't
This page describes the current state of the system in plain terms. Where a claim depends on which node ran your session, we say so rather than round it up.
Isolation
Sandbox boundary
Runtime, tiered and reported
Each session runs in Firecracker where a node exposes hardware virtualization, or under gVisor's runsc where it doesn't — the case on our node fleet today. The tier a session actually got is recorded on the session and visible in the audit log.
Network, per session
Every session gets its own isolated network bridge. Egress reaches the internet only; it cannot reach the node, other sessions, or internal/link-local/metadata addresses. Clearnet sessions egress from the node directly; darkweb sessions egress through a per-session Tor daemon.
Access, allowlisted
The viewer and media ports for your session only accept connections from your current IP address. A signed, time-limited ticket is required in addition to the IP check.
Egress policy
What a session is allowed to reach
Allowed
Outbound HTTP(S) and DNS to the public internet (clearnet sessions), or through Tor (darkweb sessions).
Denied
RFC1918 and link-local ranges, the cloud metadata service, the node itself, and every other session's network bridge. No inbound ports are opened toward a session.
Logging
What we log, and what we don't
What we log
Sign-ins with IP and rough network origin, session starts and stops and who ended them, invites, role changes, and artifact downloads — your personal audit log, and your team's if you're on Team. Session content (HAR, screenshots, video) is stored as an artifact bundle tied to the session, not folded into the audit log.
What we don't log
We don't keep session content past your plan's retention window, we don't share it with anyone but you (or your team, for team sessions), and we don't log the content of pages you view outside the artifact bundle that belongs to that session.
Disclosure
Found a problem
Tell us directly. We read every report and reply.
security@seclud.ing
For vulnerabilities, isolation failures, or anything that looks like a data leak.
Sign-in
Magic link by email, no password. A single-use, short-lived token, plus a 6-digit code fallback.
Rate limiting
Sign-up and sign-in are rate-limited per IP and per email, behind a bot check, to keep the mail sender clean.
Acceptable use
Sessions are for interactive browsing and investigation, not as a general-purpose exit node. See our acceptable use policy.