Security & Privacy

Profy implements security protections at multiple layers — from sandbox isolation for code execution, to encrypted data transmission, to anti-leak mechanisms for intellectual property, to fine-grained access control.

Sandbox Isolation

Code execution in each conversation runs in an independent cloud container, achieving process-level isolation:

Cloud Sandbox

Each conversation session gets an independent container environment. Your code never shares a runtime with other users — containers are fully isolated from each other.

Desktop Sandbox

Profy Desktop achieves OS-level sandbox isolation across all three platforms via MXC (Microsoft Execution Containers) — Windows uses ProcessContainer (process sandbox + object namespace + UI isolation), Linux uses bubblewrap (namespaces + seccomp-bpf), and macOS uses Seatbelt (kernel policy). Network access is disabled by default and switched to an outbound-allowed policy when connectivity is needed.

Cloud sandboxes are automatically cleaned up after the session ends. Files during the session are saved through a persistent file system, but the containers themselves are ephemeral — every time is a clean execution environment.

Default policy for the desktop sandbox

Every desktop command execution builds a platform-aware policy object, and the defaults are tight:

{
  "version": "0.7.0-alpha",
  "backend": "seatbelt",          // win32 → processcontainer, linux → bubblewrap
  "filesystem": {
    "readwritePaths": ["<project dir>", "<temp dir>", "~/.npm", "~/.bun"],
    "readonlyPaths":  ["/usr", "/bin", "/sbin", "/Library", "/System"]
  },
  "network": { "allowOutbound": false },
  "timeoutMs": 300000
}

Three defaults worth remembering: outbound network is denied, writes are limited to the project directory and package-manager caches, and a single execution is capped at 300 seconds. Environment variables are not passed through wholesale — they go through an allowlist (PATH, HOME, USER, LANG, TERM, TMPDIR, SHELL and 8 more, 15 keys in total). Which means a secret exported in your system environment does not silently reach the sandboxed process.

Data Protection

Transport encryption

All data is transmitted over HTTPS/TLS encryption. Communication between client and server, as well as between internal microservices, is protected by encryption.

Storage encryption

User files are stored in object storage with server-side encryption enabled. Clients never directly touch storage credentials — all file access uses temporary pre-signed URLs with time-limited validity.

Credential security

Knowledge base connector credentials are encrypted at rest and never exposed in API responses. API Keys are stored using SHA-256 hashes — the plaintext is shown once at creation time, after which the system only retains the hash.

Intellectual Property Protection

An Expert’s cognitive distillation results — mental models, decision heuristics, skill documents — are the creator’s core assets. Profy provides multi-layer protection:

Internalized, not exposed

The cognitive structures produced by distillation are internalized as the Expert’s runtime behavior and cannot be exported as raw prompt text. Users can only converse with the Expert — they cannot “download” the Expert’s persona.

Skills are not reverse-engineerable

An Expert’s skill documents guide AI behavior but are never directly output during conversations. Users experience the Expert’s capabilities, not the underlying skill definitions.

Dual-track version review

New versions of published Experts must go through review before release. During review, the old version remains online while the new version is reviewed independently, ensuring published content always remains controlled.

Memory Isolation

Each Expert’s memory is strictly isolated by user:

User A’s memory with Expert X ≠ User B’s memory with Expert X
User A’s memory with Expert X ≠ User A’s memory with Expert Y
Cross-boundary access always returns 404 (non-enumerable — it’s impossible to probe whether someone else has memories)

Temporary conversation mode (skip_memory) ensures the current conversation neither reads existing memories nor creates any new persistent traces. Suitable for handling sensitive topics.

Authentication & Permissions

Profy provides a dual-track authentication system and fine-grained access control:

Dual-Track Authentication

Auth Method	Use Case	Billing Attribution
API Key	Developer directly calls the API	Charges the developer’s own credits
OAuth	App acts on behalf of a user	Charges the authorized user’s credits

API Keys use the sk-pro- prefix and are stored with SHA-256 hashing. OAuth uses the standard Authorization Code Flow, with time-limited Access Tokens and Refresh Tokens with automatic rotation.

Permission Model

RBAC custom roles

Platform administrators can create custom roles by selecting permissions from a module-based permission tree, then assign them to team members. Every admin page has a dedicated permission code gate — having a role doesn’t mean having access to all pages.

Team permissions

Team management permissions are based on member roles (owner/admin/member), independent from platform roles. A team owner can manage their own team even without being a platform administrator.

Session isolation

Billing context uses request-level context variables to prevent session data cross-talk between concurrent requests. Different users’ conversations, files, and billing are completely isolated at the system level.

File Security

Pre-signed URLs

File access is performed through temporary pre-signed URLs with time-limited validity. Clients never directly hold storage credentials.

Per-user isolation

Each user’s files are stored under an independent namespace. File access requires identity authentication — it’s impossible to access other users’ files by guessing URLs.

Key numbers

Item	Value	Meaning
Desktop sandbox execution cap	300 seconds	Terminated on timeout
Desktop sandbox outbound network	Denied	Must switch policy explicitly to allow it
Environment variable allowlist	15 keys	Everything else never enters the sandbox
Presigned upload URL lifetime	600 seconds (10 minutes)	Re-sign after expiry
Presigned download URL lifetime	3,600 seconds (1 hour)	Re-sign after expiry
Times an API key is shown in plaintext	1	At creation; only the SHA-256 hash is stored afterwards
API key prefix	`sk-pro-`	Identifies the developer-key authentication path
Cross-user memory access returns	404	Not 403 — non-enumerable, so you can’t probe whether someone else’s data exists

Failures and fixes

Symptom	Cause	Fix
Network access denied inside the sandbox	Desktop sandboxes deny outbound network by default	Switch to the network-allowing policy before running
The sandbox can’t see an environment variable you set	Environment variables go through an allowlist	Pass the value as an argument instead of relying on the system environment
A command is killed at 300 seconds	Desktop sandbox execution cap	Split the task, or run long jobs in the cloud sandbox
A write is rejected	The path isn’t in the read-write list	Write inside the project directory
A file link stops working after a while	The presigned URL expired (1 hour download / 10 minutes upload)	Fetch a fresh link in-product instead of forwarding an old one
You lost an API key and want it back	Plaintext is shown once; only the hash is stored	It can’t be recovered — revoke and create a new one
Accessing someone else’s memory returns 404, not 403	Deliberately non-enumerable	Expected behaviour, not a bug
Asking an Expert to “remember” inside a temporary chat	Temporary chats leave no persistent trace	Use a normal session, or write the memory explicitly

Security Best Practices

Do not share database passwords, API keys, or other sensitive credentials in conversations
Use credentials with minimum necessary permissions for knowledge base connectors — avoid using full-access admin accounts
After creating an API Key, store it securely; revoke it immediately in the Platform console if compromised
When team members leave, promptly remove their membership from team management
Think before forwarding a file link — anyone holding a presigned URL can download it until it expires

Verified 2026-08-12. Sources: apps/desktop/src/main/lib/sandbox-policy.ts, services/core/src/lib/storage/s3.ts, services/core/src/middleware/developer-api-key.ts, services/core/src/db/service/memory-access.ts.

Get Started

Core Concepts

Guides

Platform & Account

Deep Dive

Security & Privacy

Sandbox Isolation

Cloud Sandbox

Desktop Sandbox

Default policy for the desktop sandbox

Data Protection

Intellectual Property Protection

Memory Isolation

Authentication & Permissions

Dual-Track Authentication

Permission Model

File Security

Pre-signed URLs

Per-user isolation

Key numbers

Failures and fixes

Security Best Practices

​Sandbox Isolation

Cloud Sandbox

Desktop Sandbox

​Default policy for the desktop sandbox

​Data Protection

​Intellectual Property Protection

​Memory Isolation

​Authentication & Permissions

​Dual-Track Authentication

​Permission Model

​File Security

Pre-signed URLs

Per-user isolation

​Key numbers

​Failures and fixes

​Security Best Practices

Sandbox Isolation

Default policy for the desktop sandbox

Data Protection

Intellectual Property Protection

Memory Isolation

Authentication & Permissions

Dual-Track Authentication

Permission Model

File Security

Key numbers

Failures and fixes

Security Best Practices