Security and privacy

How Archee keeps programs, files and credentials apart, and what you control.

Programs

• Every execute program runs in its own sandbox, created for that call and discarded after it.
• The sandbox has no network. It cannot reach the internet, your computer or other users.
• It sees only the files of the project you chose. Paths that try to leave the project, including links planted inside it, are refused.
• Time and output are capped; see Limits and credits.

Files

• Files live in your project on Archee’s servers and are visible only to your account.
• Downloads are signed links that expire.
• Design changes are checked against the revision you read, so two agents cannot silently overwrite each other.

Credentials

• Browser sign-in uses OAuth 2.1 with PKCE. You see and approve the scopes a client asks for.
• Refresh tokens are single-use. A reused one ends the whole sign-in.
• Personal access tokens are shown once and expire after 7, 30 or 90 days.
• Every connection holds only its approved scopes and never more than your plan allows.
• Revoking a connected app or token takes effect on its next request.

What you control

You want to	Do this
See what is connected	Settings → Connected apps and tokens
Cut off a client	Revoke it there
See what was spent	The Billing page, per day, item and token
Limit an automation	Give its token only the scopes it needs, with a short expiry

Report a problem

If you find a security issue, write to the Archee team from archee.studio before sharing it publicly.