Hardening in 12 points + Swiss data residency
An AI agent with access to your files, inboxes and APIs is only as safe as the server it runs on. A default install is not enough. Here is exactly how we harden every deployment.
Dedicated non-root user
The agent runs under a purpose-built, unprivileged account with no sudo rights, so a compromise can’t take over the machine.
UFW firewall, closed ports
Deny-by-default firewall: only the strictly necessary ports are open, everything else is closed to the internet.
SSH key-only + fail2ban
Password login disabled, key-based authentication only, and fail2ban bans IPs after repeated failed attempts.
TLS / HTTPS everywhere
All traffic encrypted in transit with valid certificates and auto-renewal. No plaintext endpoints exposed.
Encrypted secrets vault
API keys and tokens live in an encrypted secrets store, never in plaintext .env files or source code.
Least-privilege API scopes
Every key and integration gets the narrowest scope it needs, so a leaked token has minimal blast radius.
Automatic security updates
Unattended security patching keeps the OS and dependencies current without manual intervention.
Isolated container / VM
The agent runs inside a dedicated, isolated container or VM, separated from other workloads and the host.
Encrypted, tested backups
Regular, encrypted, off-instance backups so you can restore quickly, and restores are actually tested.
Audit logging
Actions, access and key events are logged for traceability, incident review and accountability.
Rate limiting
Request rate limits protect the agent and its APIs against abuse, runaway loops and brute-force attempts.
No data outside Switzerland/EU
Processing and storage stay within Swiss/EU jurisdiction. No data is silently shipped to third-party regions.
Your server, your name
The server stays in your name: you keep ownership and control of the infrastructure and the data on it, throughout.
Live in 48 hours, or you don’t pay.
Your data stays in Switzerland/EU, under nLPD/GDPR.