This document is superseded. Read the current Security overview.
Security overview
- One machine per customer: a private cloud computer for your agent alone; nothing is shared.
- Open internet: no incoming connections, unless you switch on a public address for your agent; you reach your pod by signing in with your email.
- Access to the machine: by cryptographic key only, password login disabled, for the reasons in section 3; support and investigations on your pod approved case by case.
- Your account: sign-in by a code sent to your email; no password.
- API keys: A key lets an agent or an app you trust see your pods and start a new one for you, which you then pay for on everpod.ai. It can’t pay, change or cancel a plan, delete anything, open your agent’s control panel, or reach a developer pod’s machine.
- Encryption: in transit, between you, your pod and its AI model provider.
- Backups: daily, rotating over roughly 7 days; restores tested.
- Deletion: everything, backups included, 7 days after your paid period ends.
- Developer pods: a computer you administer yourself, reached over your own Tailscale network, with no Everpod login on it once you have connected it (section 3).
- Incident notice: within 48 hours of confirming one.
- Hosted: in Europe.
- Report a problem: security@everpod.ai.
1. Who we are
Everpod is operated by DEH Technologies LLC, a Wyoming limited liability company, doing business as Everpod. The Terms of Service and the Privacy Policy are the binding documents; this page describes how your pod and your account are protected. Security questions and reports: security@everpod.ai.
2. Your pod is its own computer
A pod is a separate cloud computer dedicated to you, with its own accounts and files. Your agent’s software, memory, files and the credentials you give it all live on that machine, and nothing on it is shared with other customers. Your agent cannot change the protections around its own machine, so a mistake by the agent, or an attack aimed at it, cannot switch them off. A problem on another customer’s pod, whether a bug, a bad instruction or an attack aimed at their agent, stays on their pod. It has no route into yours.
Pods are hosted in Europe. Where everything is kept, and which providers touch what, is set out in the Privacy Policy, sections 4 and 8.
3. Who can reach your pod
From the internet: nobody, unless you decide otherwise. Your pod accepts no incoming connections from the open internet, which is the route attacks on an ordinary server take. The one exception is a public address for your agent, which you switch on in your pod’s settings when a task needs it: through it, other services and automations can send your agent messages, and your agent can put a web app of its own online. Nothing else on the pod is reachable through it, and the control panel never is. Your agent’s control panel is reached only through a private, authenticated path: you sign in with your email address, and our systems connect you to your pod. Knowing the panel’s address gets nobody in. Your agent can still browse and use the internet normally; its connections start from inside the pod, not from outside.
By us: narrowly. The machine your pod runs on needs maintaining, and that is our job. Setting your pod up, keeping it running, approving device pairings, running security checks, applying managed updates, doing what you ask from your pod’s page and stopping it when your subscription ends are routine, done the same way on every pod; helping when you ask for support and investigating security or abuse problems on your pod are approved case by case. Machine sign-in is by cryptographic key only, password login is disabled, and the access is used for nothing else. We do not access or read your pod’s content (conversations, memory, files) except with your permission during support, or where required for security, abuse investigation, or by law.
By you: through your agent. You use your agent through its control panel and the chat apps you connect, after signing in with your email. There is nothing on the server for you to log in to or maintain. Your agent can show you, send you, or delete anything on its computer when you ask.
Developer pods
Where this page describes how you reach your pod and how we maintain its machine and software, it means the pods we run for you. A developer pod is a cloud computer you administer yourself. It accepts no incoming connections from the open internet; you reach it over your own Tailscale network. Once you have finished connecting it, which ends with your first login, we remove the access we used to set it up, and from then on Everpod has no login on it. We host the server it runs on and back it up daily. We do not read its disk or its backups, except with your permission during support, or where the law requires it. Because we have no login, keeping its software and its settings secure is yours.
4. Your account
You sign in with a code sent to your email address, so there is no password to be stolen, guessed or reused, and repeated sign-in attempts are limited. Signing in is as secure as your email inbox: protect that inbox with two-factor authentication. A sign-in code you did not ask for means someone typed your address into our sign-in page; without the code they get nowhere, and you can ignore it.
You can also make API keys in your account, for the Everpod API. A key lets an agent or an app you trust see your pods and start a new one for you, which you then pay for on everpod.ai. It can’t pay, change or cancel a plan, delete anything, open your agent’s control panel, or reach a developer pod’s machine. A key is not a way to sign in. We show a key once, when you make it, and keep no copy of it. You can revoke a key in your account at any time, and anything using it stops working at once. Whoever holds a key can use it, so keep it secret.
Payments are handled by Paddle, which runs the checkout. We never see your card number; we receive only transaction records.
5. Encryption
Traffic between you and your pod, and between your pod and the AI model provider it thinks with, is encrypted.
6. Software and updates
Your pod’s software is kept on versions we have tested. We apply updates for you, after testing them, and an update keeps everything your agent has: its files, memory, installed tools and accounts.
7. Backups
Backups are made daily and rotate over roughly 7 days, and we test restores. A backup contains everything on the pod, your agent’s memory and credentials included, so it is protected and deleted on the same terms as the pod itself. Anything you delete on the pod ages out of backups on the same cycle.
8. Deletion
When you cancel, your pod runs to the end of the paid period and stops. 7 days later we permanently delete the machine, its contents and its backups, and revoke its credentials. Past that point the deletion cannot be undone by anyone, including us. You can ask for a full copy of your pod’s content before then (Privacy Policy, section 10).
9. What we can see, and what we cannot
Your pod’s content: not collected, not read, not indexed, not used to train anything; the only exceptions are the ones in section 3. What we can see is what it takes to run the service: your account data, your pod’s name and status, and whether the machine is running.
Your agent’s thinking goes to an AI model provider, as with any agent. For the model usage included in your plan, we send it only to providers that do not train on it. Except for models made by OpenAI, Anthropic, Google and xAI, they do not keep it either; the Privacy Policy, section 6, has the details. Your own key or subscription runs under your own agreement with that provider.
Our site and app use analytics to understand how they are used. That never touches your pod.
10. How we check our own security
Every pod is security-checked before you get the keys, and a pod that does not pass is not handed over. We test our systems and fix what we find.
OpenClaw publishes its own security guidance for everyone who runs it. On a pod:
- One trusted owner per OpenClaw, on a machine of its own: one machine per customer, a private cloud computer for your agent alone (section 2).
- No direct route from the internet to the control panel: your agent’s control panel is reached only through a private, authenticated path, and never through the public address you can switch on for your agent (section 3).
- Pairing for direct messages: once your own Telegram account is paired with your agent, anyone else who messages it gets a pairing request that waits for your approval. You can change this in the control panel.
- A dedicated browser for the agent: your agent’s browser is its own, on its own machine, and holds only the sign-ins you give it.
The encryption on this site is rated A+ by SSL Labs (October 3, 2026).
11. If something goes wrong
No one can promise absolute security, and we don’t. If we confirm a security incident affecting your data in our systems, we will notify you without undue delay and no later than 48 hours after confirming it.
12. Reporting a security problem
To report a vulnerability or a suspected incident, email security@everpod.ai with what you found, where, and the steps that show it. We confirm we have your report within 3 working days, keep you updated while we work on it, and tell you when it is fixed.
Please give us up to 90 days to fix a problem before you publish it, and do not test against our systems or other customers’ pods without our written permission (Terms of Service, section 8). For anything other than security, support@everpod.ai.
13. Changes to this page
When what we do changes materially, this page changes with it, with a new date, and previous versions stay available from this page. Questions: security@everpod.ai.