Security and trust.

This page describes what the product does today, as built. Where Prized does not do something yet, it says so.

Reaching a box

Your machine reaches a box through an encrypted WireGuard tunnel the CLI builds inside its own process, and SSH runs inside that tunnel. Nothing else on the box is reachable from the internet.

• The tunnel. prized login generates a WireGuard key and an SSH identity for this install; only the public halves are sent to Prized. No root, no TUN device, no change to your network settings.
• What the box exposes. Two inbound ports: the tunnel, and its fallback over TCP 443 for networks that block UDP. There is no inbound SSH port.
• SSH inside the tunnel. The box presents a host certificate signed by Prized, so there is no trust-on-first-use prompt. You authenticate with a user certificate minted for your token and box on each connection, valid for 15 minutes. The box account has no password.

Other ways in

Identity and access

You sign in with Google or GitHub; a Prized account has no password of its own, and a verified email address is required.

Boxes belong to a workspace and record an owner, the member who created them. Owners and members reach every box in the workspace; a contractor reaches only the boxes they own. Only the owner changes billing, the claimed domain, the invite link, membership and roles, policies, and the data-retention switch (Workspaces, Teams).

Credentials Prized issues

Only a signed-in dashboard session can mint a token, a ticket, or a phone password (the browser step of prized login is that session), so a leaked CLI token cannot mint more credentials. Removing a member revokes everything they created.

Credentials and secrets

Your agents' sign-ins travel from your machine to the box over SSH and never touch the control plane (Credentials); no API route accepts one, and CLI telemetry carries command names only.

• Secrets and connectors. A stored secret is a placeholder in the box's environment; the box's broker swaps in the real value on HTTPS requests to the hosts you allowlisted and refuses plain HTTP. The value is encrypted at rest and never read back. A secret with grants is decrypted only for the boxes named or owned by the members named; one without, for every box whose owner is not a contractor (Secrets for agents).
• What the broker does not protect against. Anything running as your user can send a request that spends a mounted secret, and root on your box can read anything on it. The broker keeps values out of env files, shell history, logs, and pasted placeholders; it is not a defense against the box itself.
• Usage metadata. Per secret and host, Prized records how often the value was swapped in and when; never a path, header, body, or value (Teams: Usage).
• Environment secret files are encrypted the same way and delivered over the box's authenticated channel (Environments). Restricted boxes receive no credentials through any channel (Safe for third parties).

Data at rest and in flight

• Disks and snapshots are encrypted at rest. Boxes run in us-west-2 (Oregon) or us-west-1 (Northern California); a snapshot stays in its box's region unless you move the box. Prized also keeps a rolling week of encrypted disaster-recovery backups of every box disk, which no customer action removes early. What a delete keeps is in Data retention.
• The control-plane database holds a box's identifiers, size, region, state, tunnel addresses, last vitals, and settings; secrets and secret files only as ciphertext.
• In flight. The site, the API, and the terminal relay serve HTTPS only, and the CLI refuses a plain-http control-plane URL anywhere but loopback.
• Telemetry. A running box reports resource vitals, listening ports, and its top processes; never file names, file contents, terminal output, or shell history (Privacy, Data retention). The activity page derives sessions from tunnel connections, never from keystrokes or screen contents.
• Error reports and logs never contain request bodies, Authorization headers, tickets, keys, or user data; the CLI and the box agent have no crash reporting.

On the box

• Processes. The box agent runs as your login user; the secrets broker, sshd, and the tunnel run as root (Machines). Their updates are signed and checksum-verified before they run.
• Your account has passwordless sudo, so anything running as you can become root. sshd accepts Prized's short-lived certificates, registered device keys, and any key in ~/.ssh/authorized_keys.
• What the control plane can tell a box. An agent version to update to, a pause request, device keys, environment variables and secret files, secret values, and the tunnel's peer list. No route carries a shell command to the box.
• What a CLI token can do. Any command on any box in your workspace (exec, files, prompts, a desktop); with sudo that is the whole machine. The audit log records lifecycle, settings, tokens, snapshots, environments, secrets, membership, policies, and every certificate minted; commands, file transfers, prompts, and desktop starts are reported by the CLI or the box, not observed. The log never contains stdout, file contents, secret values, keys, certificates, or tokens.
• Isolation. Every box is its own virtual machine with its own kernel and encrypted disk, and no cloud credentials are attached to it.

What the control plane cannot see

Your agents' sign-in tokens; secret values after you save them; commands typed over ssh, terminal output, file contents, and prompt bodies (the audit log holds a command line, a path, or a prompt's first line only when the CLI or the box reported it); and your private keys, which never leave your machine.

Sub-processors

The services that hold or carry your data, all in the United States.

The audit export posts your audit rows to an endpoint you configure; that copy is held by you.

Certifications and disclosure

None today: no SOC 2, ISO 27001, or HIPAA attestation, and no data processing agreement.

To report a vulnerability, email team@prized.dev with the steps to reproduce; we would rather hear about a problem before it is published. There is no bug bounty.