Security posture¶
What a buyer can read before trusting an unattended agent company on their
own machine. The full threat model is in docs/THREAT-MODEL.md; how to
report a problem is in SECURITY.md.
The boundary is the OS, not a prompt. Every workload runs under the operating system's sandbox from a settings file the workloads can read and not edit: no write outside its ledger, default-deny egress with the sources named, no reach to the console's socket, and no write to its state root. The contract and the guard machinery are protected paths a workload cannot change.
What the OS holds is not identical on both, and here is the difference.
| macOS | |
|---|---|
| Writes | kernel (Seatbelt) |
| Reads | kernel |
| Network | kernel |
| Process tree | kernel |
On Windows, scheduled workloads do not run yet. Claude Code's own sandbox is not available on native Windows, and SoloINC's Windows box does not yet enforce what a workload may read or reach. Rather than run an agent with less confinement than a Mac gives it, the Windows install refuses scheduled workloads: the console, the Desk and the pipelines work, and a stage that would dispatch a workload says why it cannot. This page will say when that changes.
One credential, one purpose. The seat token is a mode-600 file. The
console's passphrase is hashed; a CRITICAL change needs a one-shot second
factor -- one that hands out or changes a credential, one that binds or
exposes the company to the outside world, one that cannot be taken back.
Destructive but reversible changes ask you to confirm instead. Setting the
product up never asks for either, and ordinary work does not stop for
either. App keys are scoped (read, traces, sync) and hashed at rest; none
of them can change anything. Metered API keys are never in a
run's environment unless the Human's API switch is on.
One door, and it is local. MCP over stdio is the only way in: it runs
as the program on this machine that started it, reads what the window
reads, and offers no write tool, because this build issues no key that
could carry one. Each write tool also asks the same one-shot code the
window asks once an authenticator is enrolled. There is no A2A inbound door in
this build: no route serves an agent card and nothing can be switched on to
serve one. A cell can hand an item out to a peer over https; nothing comes
in uninvited. Every POST needs a session and a CSRF header;
a foreign Host is refused; the CSP has no inline scripts or styles.
Nothing phones home. Telemetry is local. The update check is a GET for public release metadata once a day, switchable off. Licence keys are verified offline.
Credentials never leave. The console redacts anything credential-shaped from every document it publishes; the snapshot the phone app reads while this machine is down is encrypted before it is uploaded and verified after.
Audited, reversible. Every action is on the audit log with who, what and
what it was before. pip-audit runs in the test suite against the one pinned
dependency. An accessibility pass runs statically in CI; contrast and
keyboard traps are checked in the desktop window after each merge.
Report a vulnerability to support@soloinc.ai. Acknowledged within 3 business days, assessed within 10, fixed in the next release when confirmed. No bounty programme; acknowledgement in the release notes if you want it.