Protect workspace data and findings.
- New workspaces are private by default.
- Durable workspace objects are encrypted with per-workspace data-encryption keys using authenticated AES-256-GCM encryption.
- Uploaded binaries, analysis projects, symbols, notes, traces, and related state are stored as encrypted durable workspace content.
- TLS protects browser, API, WebSocket, and MCP traffic in transit.
- Public share links are explicit capabilities and remain read-only.
Analysis and execution
Static analysis
Static analysis runs server-side inside constrained worker environments. Workspaces are separated by account and session permissions.
Live debugging
Where enabled, Linux x86-64 ELF debugging runs as an unprivileged user in a fresh private VM. The VM has no public address, service account, NAT path, or permitted network egress. It is destroyed with its temporary disk when the run stops, times out, or is torn down.
Debugging availability and isolation provider vary by deployment. User-upload debugging remains disabled unless the deployment reports a production isolation provider.
Control who acts. Review what changed.
- Session roles are creator, editor, and viewer.
- Permission checks are repeated for every operation.
- Removing or reducing a user's access also removes the agent authority derived from that user.
- Meaningful edits and agent actions are attributed in shared activity.
- Public share and writeup surfaces expose no mutation or administration capability.
Agents and model providers
Remote agents connect through OAuth or a session-scoped capability and inherit the user's current permissions. Account-owned model credentials are encrypted at rest and are never displayed again after submission.
If a user chooses an external model provider, the minimum context needed for that request is sent to the selected provider under that provider's terms. Reverser Space does not use customer binaries or workspace content to train shared models.
Retention and deletion
Workspace owners control deletion. Deleted private workspaces are recoverable for seven days, then scheduled for permanent removal from durable workspace storage. Runtime VMs and their temporary disks are disposable and do not serve as durable storage.
Operational and security records are retained only as needed to operate, secure, troubleshoot, and meet legal obligations. See the privacy notice for the categories of information processed.
Assess the deployment before uploading your samples.
Reverser Space does not currently claim SOC 2, ISO 27001, FedRAMP, or another independent compliance certification. Before an evaluation, Reverser Space can document the proposed deployment boundary, enabled capabilities, provider dependencies, retention and deletion expectations, and customer-specific security requirements. Dedicated managed deployments, on-premises setup, and security review are available by prior agreement.
Security review and vulnerability reporting
Book a security conversation for an evaluation, or email a vulnerability report with the affected component, reproduction steps, and potential impact. Please avoid accessing other users' data, disrupting the service, or publishing details before a fix can be coordinated.