Data and privacy

Overview#

SpineOS hosts its platform on dedicated infrastructure in France, encrypts sensitive information at rest and in transit, and isolates every desktop in its own virtual machine.

Where your data is stored#

The SpineOS platform runs on dedicated servers located in France (EU): your database records and backups stay there. During the platform's current test phase, some desktops — and therefore the files they hold — may run on an OVHcloud test server located in Australia; the terms of that transfer are described in section 6 of the Privacy Policy. That server is intended to be withdrawn. Your data remains subject to EU data protection laws, including GDPR.

We do not use shared cloud providers for compute. Every desktop VM runs on our own hardware -- not on AWS, GCP, or Azure.

What is encrypted#

API keys and provider configuration#

When you add your AI provider API key (Anthropic, OpenAI, or OpenRouter), it is encrypted at rest in our database before being passed to your VM. The key is only decrypted when your desktop boots and needs to connect to your provider.

Cookies#

All authentication cookies use the __Secure- or __Host- prefix, are marked httpOnly and secure, and use sameSite=lax. They are only transmitted over HTTPS, cannot be read by JavaScript, and are protected against cross-site request forgery.

Data in transit#

All connections between your browser and SpineOS use HTTPS (TLS). WebSocket connections for terminal and VNC are also encrypted. There are no unencrypted endpoints.

VM isolation#

Every desktop is a separate virtual machine with its own CPU and RAM allocation, dedicated virtual disk, and isolated network interface. VMs cannot communicate with each other.

This is not container-level isolation. Each desktop is a full virtual machine with its own kernel, so users are separated at the hardware level.

What we do not access#

• No member of our team reads your files or watches your desktop as you work.
• We do not use your data to train AI models, and we do not sell it.
• We share data only with the processors listed in our Privacy Policy, and only as far as each one needs to do its job.

Your conversations with an agent are stored, because the platform has to keep your chat history for you to come back to. So are the model's reasoning and the arguments it passed to its tools. What we collect, why, who receives it and how long it is kept is set out in full in our Privacy Policy.

Data deletion#

You can delete any desktop at any time from your dashboard. This permanently removes the VM and all associated data. If you want to delete your entire account and all associated data, contact us at contact@spinestudio.dev. See our GDPR policy for details on your data rights.