What is protected, and how
The measures below are how the platform is built. Where something is not offered, this page says so.
Your workspace
Each project has its own workspace: a container with its own storage volume, in its own Kubernetes namespace. The agents work inside it, with the tools OneActor gives them.
They can read everything in the workspace, including keys you store for development, and the workspace can reach the internet so that packages can be installed.
Keys and variables
Keys and variables are stored encrypted, per environment, with encryption keys bound to the project and the environment.
Values for test and production are never shown back — not to the agents, not to our staff, not to you — and are injected straight into your app. Values for development can be read by the agents: use test keys there.
The App Store Connect key your organization connects for iPhone builds, and the keys that sign your phone apps, are stored encrypted in the same way, and are never shown back to anyone or given to the agents.
Production
Production is off until an organization owner turns it on for the project; until then the platform refuses the agents.
Every deploy, to test as well, needs a person to press Deploy, and that press is valid for 90 minutes. Before a release is deployed, its code is scanned for keys it could leak, and you see what was found.
Databases
Each project gets its own schema and its own database login for each environment, on a shared managed Postgres cluster. No project can create anything in the shared space.
Database passwords are generated by the platform, differ for each environment, and are never shown.
Signing in
Passwords are 8 to 128 characters, checked against common and easily guessed passwords, and stored only as bcrypt hashes. Password-reset links work once, for one hour.
A new account confirms its email address with a link that works once, for 24 hours; until then it cannot create a project, pay or invite anyone.
You can sign in with a Google account instead of a password, or as well as one: OneActor receives the account's identifier, email address and name from Google, never your Google password.
Failed sign-ins are limited, and 100 failures in a row lock the password until it is reset. OneActor does not offer two-factor sign-in.
Where data is processed
The platform is operated by OneActor, a company in Portugal, and runs in AWS's Frankfurt region (eu-central-1). Sites your projects publish are served from CDN locations around the world, as cached copies. The iPhone versions of your phone apps are built on a Mac dedicated to OneActor, in Paris.
Details, and the measures against access by non-EU governments: Data location. Every company that may process your data: Sub-processors.
AI providers
When an agent works, what it is working on — your messages, code and data from your workspace — is sent to the AI provider serving the model at that moment. OneActor chooses the provider; production can use:
- Amazon BedrockEU
- MakoraUnited States
- OpenAI (through OpenAI Ireland)United States
We do not use providers or endpoints in China: models developed there run only on the providers above. Where each provider processes data, how long it keeps it and the transfer safeguard are on the sub-processor page.
What OneActor does not offer
Said plainly, so you can decide what to put on OneActor:
- Two-factor sign-in, or single sign-on with your company's identity provider: signing in with a Google account is a person's own sign-in, not your company's
- A security certification or an external audit
- A view of your app's logs in the dashboard
- Restoring a database from a backup: keep your own copies with the data export
Report a vulnerability
Write to security@oneactor.com with what you found and how to reproduce it. Please give us a chance to fix it before you publish. We do not run a bug bounty.
Our contact details for security researchers are also at /.well-known/security.txt.