Security.

Isolation

• Each account runs on its own virtual machine with its own storage. Workspaces don't share a machine.
• Each attempt runs in its own container on your machine. Your agent talks to simulated tools with credentials that only work there, so a test never needs access to your real accounts.

Credentials

• Sign-in: handled by Supabase Auth. Passwords are stored only as hashes.
• API keys: shown once and stored only as hashes. You can revoke them at any time.
• Your secrets: secrets you add, such as your own model provider key, stay on your workspace machine and are passed only to your agent.

In transit

Every public endpoint uses HTTPS.

Access

Ancha staff access a workspace only to give support you ask for, to investigate abuse, or to keep the service running.

Models and your data

Features that use language models send only the content the feature needs, through OpenRouter. We don't train models on your data. Details are in our Privacy Policy.

Where data lives

Workspaces and account records are stored in the United States (California), with Fly.io and Supabase.

Deleting your data

Email patrick@ancha.io. Within 30 days we delete your workspace machine and its storage, and your account records.

Reporting a vulnerability

• Email patrick@ancha.io with "Security" in the subject. We reply within two business days.
• Please give us reasonable time to fix the problem before you disclose it.
• While testing, don't access other people's data and don't degrade the service.