Security and trust

This page describes the product as built, including what it does not do yet.

Reaching a box

You reach a box over SSH inside an encrypted WireGuard tunnel that the CLI builds in its own process. Nothing else on the box is reachable from the internet.

• The tunnel. prized login generates a WireGuard key and an SSH identity for this install and sends Prized only the public halves. No root, no TUN device, no change to your network settings.
• What the box exposes. Two inbound ports: the tunnel, and its TCP 443 fallback for networks that block UDP. No inbound SSH port. Networks that refuse both reach the tunnel through the Prized relay (below).
• SSH inside the tunnel. The box presents a Prized-signed host certificate (renewed automatically), so there is no trust-on-first-use prompt. Each connection authenticates with a user certificate minted for your token and box, valid 15 minutes. The box account has no password.

Other ways in

Sandboxes. Commands and files in a sandbox go through Prized's edge with your API key, which needs Sandboxes: Write. The edge checks the key on every request; it never enters the sandbox.

Identity and access

You sign in with Google or GitHub and a verified email address; a Prized account has no password of its own.

A box belongs to a workspace, and its owner is the member who created it. Owners and members reach every box in the workspace; a contractor reaches only the boxes they own. Only the owner changes billing, the claimed domain, the invite link, membership and roles, policies, and the data-retention switch (Workspaces, Teams).

Credentials Prized issues

Only a signed-in dashboard session (the browser step of prized login is one) can mint or rotate a key, a ticket, or a phone password, so a leaked API key cannot mint more credentials. A key limited to some boxes, or to less access, cannot register a device SSH key, since boxes accept one for the whole workspace. Removing a member revokes everything they created. Once you request deletion of a box, its terminal and monitor tickets and phone password no longer reveal it in box lists.

Credentials and secrets

Your agents' sign-ins go from your machine to the box over SSH and never touch the control plane (Credentials); no API route accepts one, and CLI telemetry carries command names only.

• Secrets and connectors. A stored secret is a placeholder in the box's environment; the box's broker swaps in the real value on HTTPS requests to the hosts you allowlisted and refuses plain HTTP. Values are encrypted at rest and never read back. A secret with grants is decrypted only for the boxes named or owned by the members named; one without, for every box whose owner is not a contractor (Secrets for agents).
• What the broker does not protect against. Anything running as your user can spend a mounted secret, and root can read anything on the box. The broker keeps values out of env files, shell history, logs, and pasted placeholders; it is not a defense against the box itself.
• Usage metadata. Per secret and host, Prized records how often and when the value was swapped in; never a path, header, body, or value (Teams: Usage).
• AWS access never puts an access key on a box: the box trades a short-lived identity token Prized signs for temporary credentials on a role your administrator scoped and can revoke in your own account (AWS access).
• Environment secret files are encrypted the same way and delivered over the box's authenticated channel (Environments). Restricted boxes receive no credentials through any channel (Safe for third parties).

Data at rest and in flight

• Disks and snapshots are encrypted at rest. Boxes run in us-west-2 (Oregon), us-west-1 (Northern California), us-east-1 (Northern Virginia), us-east-2 (Ohio) or eu-central-1 (Frankfurt); a box's disk, snapshots and daily backups stay in its region unless you move the box. Account data and the control plane stay in us-west-2 whatever the box's region. Prized also keeps a rolling week of encrypted disaster-recovery backups of every box disk, which no customer action removes early; what a delete keeps is on Data retention.
• The control-plane database holds a box's identifiers, size, region, state, tunnel addresses, last vitals, settings, and the public half of its SSH host identity (host public key and certificate); secrets and secret files only as ciphertext. It also holds the command history of commands run with prized exec or the edge: the command line and up to the last 1 MiB of each output stream, kept 30 days, readable by members who can see the box, and kept as metadata only under zero data retention.
• Saved CLI sign-in. The CLI sends your saved token only to the service you signed in to, not to a different service selected by a config file. See CLI sign-in.
• In flight. The site, the API, and the terminal relay serve HTTPS only; the CLI refuses a plain-http control-plane URL anywhere but loopback.
• Telemetry. A running box or sandbox reports resource vitals, listening ports, and its top processes, never file names, file contents, terminal output, or shell history (the one output it sends is that of a detached command started with prized exec or the edge, to its command history) (Privacy, Data retention). The top processes also reveal a box or sandbox that is mining. The activity page derives sessions from tunnel connections, never from keystrokes or screen contents.
• Error reports and logs never contain request bodies, Authorization headers, tickets, keys, or user data; the CLI and the box agent have no crash reporting.

On the box

• Processes. The box agent runs as your login user; the secrets broker, sshd, and the tunnel run as root (Machines). Their updates are signed and checksum-verified before they run.
• Your account has passwordless sudo, so anything running as you can become root. sshd accepts Prized's short-lived certificates, registered device keys, and any key in ~/.ssh/authorized_keys.
• What the control plane can tell a box: an agent version to update to, a pause request, device keys, a renewed host certificate, environment variables and secret files, secret values, and the tunnel's peer list. No route carries a shell command to the box.
• What a full-access API key can do: any command on any box in your workspace (exec, files, prompts, a desktop), and with sudo, the whole machine. The audit log records lifecycle, settings, API keys, snapshots, environments, secrets, membership, policies, and every certificate minted; commands, file transfers, prompts, and desktop starts are reported by the CLI or the box, not observed. It never contains stdout, file contents, secret values, keys, certificates, or tokens.
• Isolation. Every box is its own virtual machine with its own kernel and encrypted disk, and no cloud credentials are attached to it.

Sandbox isolation. Every sandbox is its own Firecracker microVM with its own kernel: commands run as an unprivileged user without sudo, nothing reaches it from the internet, and sandboxes cannot reach each other.

What the control plane cannot see

• Your agents' sign-in tokens
• Secret values, once saved
• Commands typed over ssh, terminal output, file contents, and prompt bodies (the audit log holds a command line, a path, or a prompt's first line only when the CLI or the box reported it; the command history holds what prized exec and the edge ran and printed)
• Your private keys, which never leave your machine

Sub-processors

The services that hold or carry your data, all in the United States except a box in Frankfurt: its disk, snapshots, and daily backups stay in Germany (eu-central-1).

Sandboxes run on Amazon Web Services in us-west-2.

The audit export posts your audit rows to an endpoint you configure; you hold that copy.

Certifications and disclosure

Security at Prized is led by Hudson Griffith, co-founder and CEO.

SOC 2 is in progress.

To report a vulnerability, email team@prized.dev with steps to reproduce, before publishing it if you can. There is no bug bounty.