# How Poly keeps your work safe

Poly lets an AI make real changes to a real project, with several people steering it. This page says, plainly, what keeps that safe and what it does not cover.

Published 2026-09-16 by the Poly team. Canonical: https://usepoly.co/security
Poly (usepoly.co) is a web app where a team builds with AI, Claude or ChatGPT, together in a shared room. Free to start: https://usepoly.co/

**Every AI turn in Poly runs in its own throwaway container on our servers, with no route to the open internet, no API keys inside it, and a human approval from any member of the room before the AI edits or runs anything, depending on the mode the room chose.** Nothing installs on your computer, nobody supplies a key, and every change is a commit you can undo. The rest of this page is the detail, section by section. The [Privacy Policy](/privacy) is the legal version; if the two ever disagree, the policy wins.

## Where your work runs

Each turn starts a fresh container under gVisor, a sandbox that keeps the container's system calls away from the host. Its root filesystem is read-only, every Linux capability is dropped, and it carries hard limits on CPU, memory, process count and running time, so a runaway turn is stopped with a readable note in the room. The container sees exactly three things: the project's workspace, the AI's own session files, and a package cache that belongs to that project alone. When the turn ends, the container is gone. The [longer guide](/secure-shared-coding-agent-workspace) explains why this matters more once several people share one agent.

## What the AI can reach

The sandbox has no direct internet access. Its only way out is a proxy that allows a short default list: the model providers, npm, PyPI, GitHub and a few build-time hosts. Anything else is held for up to two minutes while a card in the room names the domain, and any member can allow or deny it. Nobody answering means denied. Nothing is approved automatically, because turns run while nobody is watching. Every blocked attempt is logged.

## Keys and secrets

You never give Poly an Anthropic or OpenAI key. Turns run on Poly's own provider accounts, and the platform keys never enter a sandbox: a turn carries a single-purpose token that our gateway swaps for the real key at the moment it calls the provider, meters the spend, and caps it per turn and per day.

If you connect a GitHub repository, the token you supply is encrypted at rest with AES-256-GCM, with the encryption secret kept off the data volume, and it is decrypted only at the moment of a sync and never written into git configuration. We recommend a fine-grained token scoped to the repositories you connect.

Everything the AI says into a room passes through a redaction step that scrubs text shaped like a provider key or a GitHub token before it reaches the timeline.

## Who can see a room

Rooms are invite-only. Nothing in a room is public unless a member chooses to make it so, in one of two explicit ways: a **watch link**, which lets people with no account see the timeline and group chat, view-only, and can be turned off by any member at any moment; or **Publish**, which the room's owner uses to put a static snapshot of the built app on its own address, with a note in the room saying who did it.

Inside the room, everyone sees everything: prompts, replies, code, chat, files, polls, decisions. Group chat and threads are hidden from the AI, but they are stored on our servers like the rest of the room and are visible to every member.

## Accounts

Sign-up requires a verified email address, and sign-up and password reset are protected against bots. You can turn on email two-factor authentication, or sign in with Google. Session tokens are stored hashed, so a copy of our database cannot be used to sign in as you, and you can see and revoke your active sessions from your account menu. Password reset signs out every session. Rooms check membership on every request.

## Your data

Poly runs on DigitalOcean servers in the United States. Backups are taken daily and copied, encrypted, to offsite storage, where they age out after roughly thirty days. Logs are kept for a short operational window.

Your prompts, relevant workspace contents and conversation history go to Anthropic or OpenAI, depending on the model chosen for each turn, under Poly's accounts with them. Card details go straight to Stripe and never touch our servers.

You can delete your account yourself from Security and sessions. Rooms you own and nobody else belongs to are deleted with it; shared rooms pass to their longest-standing member; your messages in other rooms lose their author. You can also sync any room's code to your own GitHub at any time.

## What this page does not claim

Poly is a hosted product. Room content is not end-to-end encrypted, and the people who operate Poly can technically access it, as the Privacy Policy says. Hosts on the network allowlist are reachable by design, so the AI could send a project's own files to, say, a GitHub repository if told to; the room sees every domain that is added, and spend is capped. Members of a room can influence each other's turns; that is what sharing an agent means, and the approvals and one-click revert exist for it.

## Reporting a problem

If you find a vulnerability, email **support@usepoly.co**. We read everything, we will reply, and we will not take action against anyone who reports in good faith. Security questionnaires can go to the same address.

## Common questions

**Does anything run on my computer?**

No. Poly runs in the browser, and every AI turn runs in a fresh container on our servers. Nothing installs on a member's machine and no member's credentials are inside the sandbox.

**Do I need to give Poly an API key?**

No. Turns run on Poly's own provider accounts and are billed to you as credits. Poly's keys never enter a sandbox.

**Where is my data stored?**

On DigitalOcean servers in the United States, with daily backups copied encrypted to offsite storage that ages out after about thirty days.

**Can the AI reach the internet?**

Only an allowlist: the model providers, package registries, GitHub, and any domain the room has approved. A new domain is held and shown to the room to allow or deny; nothing is approved automatically.

**What happens when I delete my account?**

Rooms you own alone are deleted with it, shared rooms pass to their longest-standing member, your messages elsewhere lose their author, and any subscription is cancelled. You can do it yourself from Security and sessions.

**How do I report a security issue?**

Email support@usepoly.co. Good-faith reports are welcome and will not be penalised.

More guides: https://usepoly.co/guides · Security: https://usepoly.co/security · Pricing: https://usepoly.co/pricing