Isolate the binary. Bound the agent.

Workspace data

• New workspaces are private by default.
• Durable workspace objects are encrypted with per-workspace data-encryption keys using authenticated AES-256-GCM encryption.
• Uploaded binaries, Ghidra projects, symbols, notes, traces, and related state are stored as encrypted durable workspace content.
• TLS protects browser, API, WebSocket, and MCP traffic in transit.
• Public share links are explicit capabilities and remain read-only.

Analysis and execution

Static analysis

Ghidra analysis runs server-side inside constrained worker environments. Workspaces are separated by account and session permissions.

Live debugging

Where enabled, Linux x86-64 ELF debugging runs as an unprivileged user in a fresh private VM. The VM has no public address, service account, NAT path, or permitted network egress. It is destroyed with its temporary disk when the run stops, times out, or is torn down.

Debugging availability and isolation provider vary by deployment. User-upload debugging remains disabled unless the deployment reports a production isolation provider.

Authorization and audit

• Session roles are creator, editor, and viewer.
• Permission checks are repeated for every operation.
• Removing or reducing a user's access also removes the agent authority derived from that user.
• Meaningful edits and agent actions are attributed in shared activity.
• Public share and writeup surfaces expose no mutation or administration capability.

Agents and model providers

Remote agents connect through OAuth or a session-scoped capability and inherit the user's current permissions. Account-owned model credentials are encrypted at rest and are never displayed again after submission.

If a user chooses an external model provider, the minimum context needed for that request is sent to the selected provider under that provider's terms. Reverser Space does not use customer binaries or workspace content to train shared models.

Retention and deletion

Workspace owners control deletion. Deleted private workspaces are recoverable for seven days, then scheduled for permanent removal from durable workspace storage. Runtime VMs and their temporary disks are disposable and do not serve as durable storage.

Operational and security records are retained only as needed to operate, secure, troubleshoot, and meet legal obligations. See the privacy notice for the categories of information processed.

Current assurance

Reverser Space does not currently claim SOC 2, ISO 27001, FedRAMP, or another independent compliance certification. Dedicated managed deployments and customer-specific security review are available by prior agreement.