# Security and trust > How a box is reached, what the control plane can and cannot see, where credentials and secrets go, and how to report a problem. URL: https://prized.dev/docs/security This page describes what the product does today, as built. Where Prized does not do something yet, it says so. ## Reaching a box [#reaching-a-box] Your machine reaches a box through an encrypted WireGuard tunnel the CLI builds inside its own process, and SSH runs inside that tunnel. Nothing else on the box is reachable from the internet. * **The tunnel.** `prized login` generates a WireGuard key and an SSH identity for this install; only the public halves are sent to Prized. No root, no TUN device, no change to your network settings. * **What the box exposes.** Two inbound ports: the tunnel, and its fallback over TCP 443 for networks that block UDP. There is no inbound SSH port. * **SSH inside the tunnel.** The box presents a host certificate signed by Prized, which it renews automatically, so there is no trust-on-first-use prompt. You authenticate with a user certificate minted for your token and box on each connection, valid for 15 minutes. The box account has no password. ### Other ways in [#other-ways-in] | Path | Credential | What it reaches | | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Browser terminal, files, desktop | A ticket from your signed-in dashboard session: one box, 10 minutes, never in a URL | A relay opens its own tunnel and certificate per request; it terminates both encrypted hops, so it can read the session as it passes, and stores nothing. | | Box monitor | A monitor ticket, same lifetime | The box's process and port list, nothing else. | | Shared port link | A viewer cookie on the link's own hostname, minted from your signed-in session, 12 hours, checked against your membership on every use | One port on one box, over HTTP; the same relay as the terminal, so it can read the traffic as it passes. Only members of the box's workspace who can see the box get one; stopping the share, deleting the box, or removing the member ends it ([Share a port](https://prized.dev/docs/ports#share-a-port-with-your-team)). | | Phone (the ChatGPT app) | A phone password for one box: shown once, stored hashed, revocable | The SSH gateway checks it, wakes the box, and bridges the session, so it too can read it as it passes. Terminal only; failed passwords are rate limited. | | Desktop apps (Claude Desktop) | This machine's SSH public key, registered by `prized login` | A restricted, tunnel-only key ([Claude Desktop remote](https://prized.dev/docs/claude-desktop#what-the-fallback-key-can-do)). | | Scripts and agents | Your CLI token (`dcp_`) | Everything the dashboard can do short of minting credentials or changing membership, roles, or policies, the [edge API](https://prized.dev/docs/exec#the-edge-api) included. An owner's token also reaches billing; a contractor's reaches only the boxes they own. | ## Identity and access [#identity-and-access] You sign in with Google or GitHub; a Prized account has no password of its own, and a verified email address is required. Boxes belong to a workspace and record an owner, the member who created them. Owners and members reach every box in the workspace; a contractor reaches only the boxes they own. Only the owner changes billing, the claimed domain, the invite link, membership and roles, policies, and the data-retention switch ([Workspaces](https://prized.dev/docs/workspaces), [Teams](https://prized.dev/docs/teams)). ### Credentials Prized issues [#credentials-prized-issues] | Credential | Scope | Stored as | Ends when | | ---------------------------- | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CLI token `dcp_` | The workspace, for one machine | sha256 hash; shown once | You revoke it or the member is removed; its tunnel closes and its device key leaves your boxes ([CLI tokens](https://prized.dev/docs/workspaces#cli-tokens)) | | Terminal and monitor tickets | One box | sha256 hash | 10 minutes after minting | | Phone password | One box | sha256 hash; shown once | Revoked, replaced, the box deleted, or its member removed | | Device SSH key | One CLI token | ed25519 public key | With its token ([Removing a device](https://prized.dev/docs/claude-desktop#removing-a-device)) | | SSH user certificate | Your workspace and one box | Not stored; one [audit row](https://prized.dev/docs/teams#audit-log) (`box.connect`) records who, which credential, which box, when | 15 minutes after minting | | AWS identity token | One box, for the IAM roles the workspace owner connected | Not stored; the box holds it and renews it | One hour after minting, and the box stops receiving new tokens when the role is removed or its owner leaves or is removed from the workspace ([AWS access](https://prized.dev/docs/aws)) | Only a signed-in dashboard session can mint a token, a ticket, or a phone password (the browser step of `prized login` is that session), so a leaked CLI token cannot mint more credentials. Removing a member revokes everything they created. ## Credentials and secrets [#credentials-and-secrets] Your agents' sign-ins travel from your machine to the box over SSH and never touch the control plane ([Credentials](https://prized.dev/docs/credentials)); no API route accepts one, and CLI telemetry carries command names only. * **Secrets and connectors.** A stored secret is a placeholder in the box's environment; the box's broker swaps in the real value on HTTPS requests to the hosts you allowlisted and refuses plain HTTP. The value is encrypted at rest and never read back. A secret with [grants](https://prized.dev/docs/teams#scoped-secrets) is decrypted only for the boxes named or owned by the members named; one without, for every box whose owner is not a contractor ([Secrets for agents](https://prized.dev/docs/credentials#secrets-for-agents)). * **What the broker does not protect against.** Anything running as your user can send a request that spends a mounted secret, and root on your box can read anything on it. The broker keeps values out of env files, shell history, logs, and pasted placeholders; it is not a defense against the box itself. * **Usage metadata.** Per secret and host, Prized records how often the value was swapped in and when; never a path, header, body, or value ([Teams: Usage](https://prized.dev/docs/teams#usage)). * **AWS access** never places an access key on a box: the box presents a short-lived identity token Prized signs, and AWS answers with temporary credentials for a role your administrator scoped and can revoke in your own account ([AWS access](https://prized.dev/docs/aws)). * **Environment secret files** are encrypted the same way and delivered over the box's authenticated channel ([Environments](https://prized.dev/docs/environments#vars-and-secret-files)). **Restricted boxes** receive no credentials through any channel ([Safe for third parties](https://prized.dev/docs/environments#safe-for-third-parties)). ## Data at rest and in flight [#data-at-rest-and-in-flight] * **Disks and snapshots** are encrypted at rest. Boxes run in `us-west-2` (Oregon) or `us-west-1` (Northern California); a snapshot stays in its box's region unless you move the box. Prized also keeps a rolling week of encrypted disaster-recovery backups of every box disk, which no customer action removes early. What a delete keeps is in [Data retention](https://prized.dev/docs/data-retention#records-retained-after-deletion). * **The control-plane database** holds a box's identifiers, size, region, state, tunnel addresses, last vitals, settings, and the public half of its SSH host identity (the host public key and certificate); secrets and secret files only as ciphertext. * **In flight.** The site, the API, and the terminal relay serve HTTPS only, and the CLI refuses a plain-`http` control-plane URL anywhere but loopback. * **Telemetry.** A running box reports resource vitals, listening ports, and its top processes; never file names, file contents, terminal output, or shell history ([Privacy](https://prized.dev/docs/privacy), [Data retention](https://prized.dev/docs/data-retention#telemetry-retention-windows)). The top processes are also how a box that is [mining](https://prized.dev/docs/limits#not-allowed) is found. The [activity page](https://prized.dev/docs/teams#team-activity) derives sessions from tunnel connections, never from keystrokes or screen contents. * **Error reports and logs** never contain request bodies, `Authorization` headers, tickets, keys, or user data; the CLI and the box agent have no crash reporting. ## On the box [#on-the-box] * **Processes.** The box agent runs as your login user; the secrets broker, `sshd`, and the tunnel run as root ([Machines](https://prized.dev/docs/machines#what-runs-on-the-box)). Their updates are signed and checksum-verified before they run. * **Your account** has passwordless sudo, so anything running as you can become root. `sshd` accepts Prized's short-lived certificates, registered device keys, and any key in `~/.ssh/authorized_keys`. * **What the control plane can tell a box.** An agent version to update to, a pause request, device keys, a renewed host certificate, environment variables and secret files, secret values, and the tunnel's peer list. No route carries a shell command to the box. * **What a CLI token can do.** Any command on any box in your workspace ([exec](https://prized.dev/docs/exec), files, [prompts](https://prized.dev/docs/remote-agents), a desktop); with sudo that is the whole machine. The [audit log](https://prized.dev/docs/teams#audit-log) records lifecycle, settings, tokens, snapshots, environments, secrets, membership, policies, and every certificate minted; commands, file transfers, prompts, and desktop starts are **reported** by the CLI or the box, not observed. The log never contains stdout, file contents, secret values, keys, certificates, or tokens. * **Isolation.** Every box is its own virtual machine with its own kernel and encrypted disk, and no cloud credentials are attached to it. ## What the control plane cannot see [#what-the-control-plane-cannot-see] Your agents' sign-in tokens; secret values after you save them; commands typed over ssh, terminal output, file contents, and prompt bodies (the audit log holds a command line, a path, or a prompt's first line only when the CLI or the box reported it); and your private keys, which never leave your machine. ## Sub-processors [#sub-processors] The services that hold or carry your data, all in the United States. | Service | What for | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | Amazon Web Services | Boxes, disks, snapshots, release artifacts, database backups, and the API, terminal relay, and SSH gateway, in `us-west-2` and `us-west-1` | | Vercel | The site and dashboard, and aggregate page-view analytics | | Neon | The control-plane database | | Stripe | Billing, invoices, and card storage | | PostHog | Product events, session replay, and browser errors | | Sentry | Server-side error reports | | Cloudflare | DNS and transactional email | | Google, GitHub | Sign-in | | Anthropic | The environment advisor in `prized setup`, only when you use it; it receives a redacted inventory of your machine | The [audit export](https://prized.dev/docs/teams#scheduled-export) posts your audit rows to an endpoint you configure; that copy is held by you. ## Certifications and disclosure [#certifications-and-disclosure] None today: no SOC 2, ISO 27001, or HIPAA attestation, and no data processing agreement. To report a vulnerability, email the support address shown on https://prized.dev/docs/troubleshooting with the steps to reproduce; we would rather hear about a problem before it is published. There is no bug bounty.