Sanbox by Sanlabs · https://sanbox.cloud/trust/

[Home](https://sanbox.cloud/)

# Trust Center

Sanlabs GmbH last updated November 6, 2026

This page describes how Sanlabs GmbH protects your data on the Sanbox cloud platform: where it is stored, how Computers are isolated, how we encrypt data and control access, which kinds of service providers we use, and how to report a security issue. For a vendor review, we send you our data processing agreement, our sub-processor list and our technical and organisational measures on [request](https://sanbox.cloud/trust/#documents).

## Where your data is

Sanbox is provided by Sanlabs GmbH, Berlin, a company under German law. Computers, their disks and snapshots, uploaded files, run records, accounts and logs are stored and processed in data centres in the EU. Account emails, such as sign-up and password-reset emails, are sent from the EU.

Data that your Computers send to services you connect yourself, such as your model providers, leaves Sanbox under your own agreements with those providers. Our [EU Data Act information](https://sanbox.cloud/data-act/) explains how we handle requests from authorities outside the EU, and how to switch provider or export your data.

## Isolation

- **A machine of its own.** Each Computer runs in its own Firecracker microVM, with its own kernel and its own private disk, separated from other Computers by hardware virtualisation. Firecracker's jailer confines each microVM's process on the server.
- **Deny-by-default network.** A Computer reaches the model provider configured for its template and the destinations you allow in its network policy, and nothing else.
- **Credentials outside the Computer.** With Secret Proxies, Sanbox adds a credential to an outgoing request on its way out of the Computer, so the agent can use an API without ever seeing the key.
- **Inbound access you choose.** A Computer accepts no inbound connections until you open a port, and you can limit each open port to the source IP addresses you choose.

## Encryption

- **In transit.** Connections to the console, the API and the CLI use TLS. Traffic between our servers runs through encrypted WireGuard tunnels.
- **Credentials.** Model provider keys, OAuth tokens and Secret Proxy credentials are encrypted at application level with AES-256-GCM.
- **Database.** Our database is encrypted at rest.
- **Workspace copies.** When a Computer's workspace is copied to object storage, it is encrypted with AES-256-GCM before it leaves the server, with keys that Sanlabs holds.

## Access control

- **Organisations.** Your data belongs to your organisation. Organisation admins invite members and give each a role: viewer, member, admin or owner.
- **API keys.** Every API key belongs to one organisation and carries a role. We store keys only as hashes.
- **Two-factor sign-in.** Console accounts can turn on two-factor authentication with an authenticator app.
- **Our own access.** Access to production systems is limited to Sanlabs engineering and uses SSH keys.

## Reliability and backups

- Server disks are mirrored.
- When a Computer stops, its workspace is copied, encrypted, to object storage shortly afterwards.
- Our database is backed up daily, and each backup is kept for 7 days.
- We monitor availability around the clock from several locations in the EU, with automatic alerts.

## Data retention and deletion

- Our central log store keeps application logs for 14 days.
- When you delete a Computer, its disk is removed from the server, and its stored copy is erased within 14 days.
- Our data processing agreement commits us to delete your data from live systems within 14 days of your instruction, and from backups and logs within 30 days.
- After your subscription ends, you can retrieve your data free of charge for 30 days, as our [EU Data Act information](https://sanbox.cloud/data-act/) sets out.

## Security incidents

We notify you of a personal data breach within 48 hours at most, with a target of 24 hours, as our data processing agreement sets out. We also tell you about requests from authorities for your data, unless the law forbids it.

## How we ship changes

Every change runs on our staging environment before it reaches production. A production release ships only after its automated release build passes and the change has run on staging first. Most updates roll out without restarting running Computers.

## Sub-processors

We use a small number of service providers to run Sanbox. Each is bound by a data processing agreement and processes your data in EU data centres. Where a provider is based outside the EU, our agreement with it includes the EU Standard Contractual Clauses.

| Service | Used for | Location |
| --- | --- | --- |
| Data centres and object storage | Computers, their disks and snapshots, workspace copies, uploaded files, model gateways | EU |
| Database and sign-in | Accounts, organisations, run records, encrypted credentials | EU |
| Monitoring | Service logs and metrics | EU |
| Account email | Sign-up and password-reset emails | EU |

Our data processing agreement names each provider, and we send the list on request. We tell customers by email at least 14 days before we add or replace a provider, and you can object.

## Compliance

- **GDPR.** Our data processing agreement follows Article 28 GDPR and is governed by German law.
- **EU Data Act.** Our [EU Data Act information](https://sanbox.cloud/data-act/) covers jurisdiction, protection against access by authorities outside the EU, switching and export.
- **Providers.** Our data centre, database and monitoring providers are certified to ISO/IEC 27001.
- **No model training.** Sanlabs does not use your data to train AI models.

## Documents for vendor reviews

For a vendor review or supplier assessment, write to [support@sanlabs.ai](mailto:support@sanlabs.ai). We send you:

- our data processing agreement,
- our sub-processor list with locations,
- our technical and organisational measures,
- our exit procedure under the EU Data Act.

## Reporting a security issue

If you believe you have found a security vulnerability in Sanbox, email [security@sanlabs.ai](mailto:security@sanlabs.ai). Include the affected address or component, the steps to reproduce it and what an attacker could do with it. We confirm receipt within 3 working days and keep you updated until the issue is fixed.

When you test, please:

- use only your own account and your own Computers,
- never access, change or delete other customers' data,
- avoid anything that degrades the service, such as denial of service, spam or social engineering,
- give us reasonable time to fix the issue before you disclose it.

If you follow these rules in good faith, we will not take legal action against you for your research. Our contact details are also in our [security.txt](https://sanbox.cloud/.well-known/security.txt).