Skip to content
Enterprise

For procurement and audit.

Durability is an engineering purchase and an audit purchase at the same time. Both columns below describe the same system, so nobody has to translate for the other. The hosted service runs today and prepaid credits are purchasable; the enterprise surface (SSO, SLA) is the planned half, and every row says which side of that line it sits on.

For the person who signs

What your engineers install is a CLI. Where sessions run is our fleet, in microVMs we checkpoint whole. What leaves your laptop is the workspace an engineer chooses to sync, named flag by flag; what never leaves is everything else. If you bring your own provider keys, they never enter a guest, an image, or a snapshot, and the token meter disappears from your bill. The rules behind each of those sentences, and which ones are gated versus policy, are written on Security, and the full asset/boundary/control picture is the threat model.

Platform

Your engineers get durability. The token saving is whatever your metered trace says it is.

Historical tests cover Claude Code and aider. Compatibility depends on the client version and operation; other agents require their own test evidence.

Historical Apple Silicon agent-session tests measured 13.7–25.2 seconds. Sub-second resume remains planned. Provider compatibility is specific to the tested provider and protocol; these measurements are not a recovery-time guarantee.

Billed at most once, gateway-enforced: proven for Claude Code. For aider the gateway held the response 4 of 4 times and the client returned 3 of 4. Reported, not promised.

Per-session token budgets are enforced by the gateway; exceeding one checkpoints and parks. Fan-out budget pools have no gate yet, so that sentence is product behavior, not proof.

Fleet view of parked agents, waking on schedule or on webhook: planned. The hosted service runs today; this fleet view is not built yet.

MEASURED, bench

Compliance

Your auditors get two ledgers of one history, reconciled by sequence number.

Designed for the hosted service; none of the hosted surface is gated yet. The lineage machinery underneath it is (gate-3, gate-5).

Two ledgers, one history: the host event log and the guest transcript reconcile by sequence number, and the reconciliation is recorded before the agent wakes.

Sequence lineage on every event: each fork-point record names its parent lineage and sequence.

Deterministic full-run replay: roadmap. What is gated today is narrower: pre-steer request bodies identical to the byte across three forked branches.

Retention and deletion policy v1.0 · approved 2026-09-09. Checkpoint content: retained while the account exists; no automatic expiry. Deletion: deletable by the customer, per session; the key is destroyed on account deletion. Backups: encrypted, and unreadable once the key is destroyed; backup retention 30 days. The full matrix, every category with its evidence, is on Security and in the Privacy Policy. Legal holds are not currently supported; retention proceeds as stated unless law requires otherwise.

Audit bundle export as a signed archive: roadmap. No export path exists yet.

SIEM webhook, SSO and SCIM, scheduler-enforced region pinning: planned for the hosted service.

Procurement readiness.

There is no SLA yet. Service levels arrive when we can publish probe-measured numbers instead of aspirations, and no external probe or on-call rotation exists to measure them today, which Status reports as it stands. This is the ledger of what procurement will ask, as of 2026-08-24.

what procurement asks · status today · the honest detail — full table
what procurement asks status today the honest detail when it changes
SOC 2 Type II not started no audit window is open this row gets a date only when one opens
External penetration test not commissioned no firm engaged yet summary published when it exists
SLA and uptime no published number the hosted service runs today; the number arrives probe-measured probe-measured before we publish a number
SSO and SCIM planned hosted surface nothing gated yet
Regions and pinning planned one region live today (Europe, x86_64 fleet); pinning enforced when a second exists see the region list below
Retention and deletion policy v1.0, final approved 2026-09-09 a versioned reissue, never an edit in place
Legal hold not offered Legal holds are not currently supported; retention proceeds as stated unless law requires otherwise. ruled 2026-09-09

Checkpoint durability is a data claim, not an uptime claim, and it is gated separately on the Proof page. Every planned row above defers to the dated availability matrix.

Where your sessions can live.

The design puts region pinning in the scheduler, so a checkpoint could not be written outside the region you pin. One region runs today and it is the row below. Pinning is enforced when a second region exists; no further region is scheduled, and we do not list cities we have not committed to. Planned rows defer to the dated availability matrix.

Europe Azure, x86_64 fleet
live
Security review pack

Everything procurement asks for, stated as it is.

What exists is readable now, no form and no call first. The public security summary below is a real, versioned file with its own digest. It preserves legal commitments and material implementation gaps; it is not a certification or a current production audit. No restricted evaluation pack is currently offered.

Download the public security summary (plain text, 4.8 KB)
Legal documents: terms, privacy, DPA
terms v1.1 · privacy v1.0 · DPA v1.0
Subprocessor list
v1.0, real vendors
Dated proof summaries
Test outcomes, scope and limitations
Architecture and limits
Customer-facing state boundary and measured limitations
Penetration test summary
not yet commissioned
See the walkthrough

SOC 2 Type II · not yet claimed · this line gets a date only when an audit window opens

The real key never enters a guest, an image, or a snapshot.

Real keys live root-only on the host, outside every guest, image, and snapshot. The gateway mints a virtual key scoped to one session, and that is the only credential a VM ever sees. Gateway-managed provider keys stay outside the guest. Secrets placed in the workspace or process memory can be captured in checkpoints. This is the path gate-3 exercised; the hosted vault now holds customer provider keys in production, each sealed under its account's own key, and the HSM language is design, labeled planned.

host key store

your real provider key, root-only on the host, in the gate-3 path, outside the boundary. Hosted vault in production, each key sealed under its account's own key; with HSM root: planned

gateway

mints a virtual key scoped to one session, meters, enforces exactly-once billing

micro-VM

the agent, its filesystem, its tools. Sees the virtual key only

checkpoint store

content-addressed chunks; the gateway-managed provider key never enters a checkpoint, and any secret an agent writes into its workspace is captured by checkpoints. Historical account-deletion tests passed under the stated key-custody conditions. Current deployment is not independently verified. Deleting a session erases the content only it held, in production since 6 October 2026; a production check through the customer deletion route is still owed

Our own build is governed by the same audit discipline we sell.

Public summaries explain what was tested, when, and what remains unproven.

Discuss a Cruise trial Read the public proof

keepstate.ai · the durable agent session cloud