Sandcastle applies layered security controls at every stage - from API authentication and sandbox isolation to EU data residency enforcement and provider audit trails. Your workflows run in ephemeral sandboxes with zero trust by default.
Every request passes through multiple independent security layers. A failure in one layer is caught by the next.
Every feature listed below ships with Sandcastle out of the box. No plugins, no paid tiers, no configuration required for the defaults.
AI agent code runs in ephemeral sandboxes that are destroyed after each execution. No shared state, no persistent access to host resources. Docker containers run with seccomp profiles and dropped capabilities.
CapDrop: ALL, seccomp syscall allowlist, PID limits, CPU quotas, non-root user (UID 1000), bridge networking, auto-remove..) and absolute paths before executionAPI key authentication with HMAC-SHA256 hashing, key rotation with grace periods, expiry enforcement, and per-key IP allowlisting.
API_KEY_PEPPER)X-API-Key header, Authorization: Bearer, or query param (SSE)POST /api/api-keys/{id}/rotate generates new key, old key enters configurable grace periodexpires_at enforced in auth middleware, returns 401 KEY_EXPIREDsc_ prefix with 32-byte URL-safe random token, first 8 chars stored as key_prefixlast_used_at timestamp updated on every authenticated requestis_active flag - preserves audit trailEach API key is scoped to a tenant. Tenant-scoped queries filter all data access to prevent cross-tenant leaks.
tenant_id set from API key on every request via middlewaremax_cost_per_run_usd)Declarative policy rules that evaluate step outputs in real-time. Automatically redact PII, block secrets, and trigger approvals.
simpleeval (no Python eval/exec)All webhook callback URLs are validated against private network ranges before any HTTP request is made.
127.0.0.0/8, ::1)10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)169.254.0.0/16) and IPv6 ULA (fc00::/7)http:// and https://All file operations are sandboxed within base directories. Resolved paths are validated to prevent escape.
Path.resolve() + is_relative_to() check on all storage operationsValueError on traversal attempts (../../etc/passwd).... and absolute pathsPluggable rate limiting with in-memory and distributed Redis backends. Sliding window counter per tenant or IP prevents abuse of sandbox endpoints.
tenant:{id} when authenticated, ip:{addr} when anonymousREDIS_URL is setRetry-After, X-RateLimit-Limit, X-RateLimit-Remaining headersTool credentials are encrypted at rest with Fernet symmetric encryption, resolved from environment variables or database-stored named connections. Never logged, never exposed in outputs.
CREDENTIAL_ENCRYPTION_KEYTOOL_* prefix convention for environment variablespostgresql:analytics) stored in DB with unique constraint/workflows/{name}/export) sanitizes credentials from YAMLOpt-in error reporting via Sentry with aggressive anonymization. Disabled by default. No user data, no secrets, no hostnames.
TELEMETRY_ENABLED=true + SENTRY_DSNsend_default_pii=False, server_name=None, zero tracingdata/error_reports/Outgoing webhooks are signed with HMAC-SHA256. Recipients can verify authenticity using the signature header.
X-Sandcastle-Signaturehmac.compare_digest()Middleware injects hardened HTTP headers on every response. Content Security Policy applied to dashboard routes, with a report-only mode for gradual rollout.
X-Content-Type-Options: nosniff - prevents MIME sniffingX-Frame-Options: DENY - blocks clickjackingReferrer-Policy: strict-origin-when-cross-originPermissions-Policy - disables camera, microphone, geolocation, paymentdefault-src 'self' with scoped overrides for styles, scripts, images, fonts/api) to avoid breaking JSON responsesCSP_REPORT_ONLY=true uses Content-Security-Policy-Report-Only header for safe testingThree-state circuit breaker protects against cascading backend failures. Automatically recovers when the backend stabilizes.
SHA-256 hash chain audit trail. Every event links to the previous via cryptographic hash - tamper-evident and independently verifiable.
entry_hash (SHA-256 of payload) and prev_hash linking to previous eventGET /audit/runs/{run_id} - full event log for a runGET /audit/verify/{run_id} - verify chain integrity, returns broken linksGET /audit/admin - paginated admin action logThe policy engine automatically detects and redacts credentials from 30+ services in step outputs. Two-layer defense: PEM key blocks first, then token regex. Idempotent - safe to run twice. Patterns applied before data reaches storage, webhooks, or logs.
| Category | Services / Patterns | Examples |
|---|---|---|
| Communication | Slack, Discord, Twilio, SendGrid, Resend, WhatsApp, Intercom | xoxb- xoxp- SG. |
| AI Providers | OpenAI, Anthropic, ElevenLabs, Tavily | sk- sk-ant- |
| Cloud & DevOps | AWS, Vercel, Datadog, PagerDuty, Cloudflare | AKIA Bearer |
| Version Control | GitHub, Jira, Linear | ghp_ gho_ |
| Data & Storage | Supabase, Pinecone, Airtable, Snowflake, Redis | eyJ (JWT) UUID patterns |
| Payments & ERP | Stripe, Shopify, Plaid, QuickBooks, DocuSign | sk_live_ sk_test_ |
| CRM | HubSpot, Salesforce, Zendesk | pat- Bearer tokens |
| PII | Email, Phone, SSN, Credit Card | Regex patterns for common PII formats |
| Connection URLs | PostgreSQL, Redis, MySQL, MongoDB connection strings | postgres://user:pass@host redis://:pass@host |
| PEM Private Keys | RSA, EC, DSA, ENCRYPTED private key blocks | -----BEGIN RSA PRIVATE KEY----- |
| Cloud Credentials | Azure Storage AccountKey, AWS compound keywords | AccountKey=... aws_secret_access_key |
| JSON Secrets | JSON-quoted key/value pairs containing secrets | "password": "value" "secret": "..." |
v0.2666 adds hard enforcement where previous versions had soft controls. Data residency, provider failover, and cost tracking - all with full audit trail.
Set DATA_RESIDENCY=eu and all AI processing routes through EU-based providers (Mistral) or stays local (Ollama). This is not a policy document - it's hard enforcement at the routing layer.
GET /compliance/privacy-noticeProvider hits rate limit or returns 5xx? Sandcastle switches to the next provider in the failover chain automatically. Per-provider cooldown prevents hammering a failing endpoint.
Every AI call logs which provider handled it, which model was used, which region the data was processed in, and whether it was a failover event.
Critical operations automatically get the most capable model. Simple tasks get the cheapest. No manual configuration - quality tier matching is automatic per task purpose.
ADVISOR_QUALITY_MODE=always_best or always_cheapestDeadline: August 2, 2026. Sandcastle is the first AI orchestrator with native EU AI Act support.
Risk classification, tamper-evident audit trail, transparency reports, technical documentation generation, PII redaction, and emergency stop - all configured in YAML, enforced at runtime.
Classify workflows as minimal, limited, high, or unacceptable per EU AI Act Annex III. High-risk workflows require human approval gates.
risk_level: high
SHA-256 hash chain on every event. Each entry links to the previous via cryptographic hash. Chain integrity verifiable via API.
GET /audit/verify/{run_id}
Article 13 compliant reports generated per-run. AI models used, human oversight, policy violations, cost breakdown.
GET /runs/{id}/transparency-report
Auto-generated technical documentation stubs covering intended purpose, AI models, risk classification, testing evidence, and data handling.
GET /workflows/{name}/annex-iv
One API call halts all running and queued workflows. In-memory + Redis flag checked by executor before every step.
POST /admin/emergency-stop
Set COMPLIANCE_MODE=eu_ai_act to enforce: high-risk workflows without approval steps are blocked, not just warned.
compliance_mode: eu_ai_act
7 PII patterns detected and redacted before data leaves your infrastructure.
| Pattern | Example | Redacted As |
|---|---|---|
| user@company.com | [EMAIL] | |
| Phone | +1 (555) 123-4567 | [PHONE] |
| SSN | 123-45-6789 | [SSN] |
| Credit Card | 4111 1111 1111 1111 | [CREDIT_CARD] |
| IP Address | 192.168.1.1 | [IP_ADDRESS] |
| IBAN | DE89 3704 0044 0532 | [IBAN] |
| Date of Birth | 15/03/1990 | [DOB] |
privacy:
enabled: true
mode: redact
entities: [email, phone, ssn]
apply_to: [outputs, webhooks]PRIVACY_ENABLED=true
PRIVACY_ENTITIES=email,phone,ssn,credit_card
PRIVACY_APPLY_TO=outputs,webhooksSandcastle's security controls align with industry compliance frameworks. E2B's cloud sandbox backend holds SOC 2 Type II certification.
E2B cloud sandbox infrastructure is SOC 2 Type II certified
Multi-tenant scoping on every API query. Ephemeral sandboxes with zero shared state
Policy violations, approval decisions, and key usage tracked in database
Fernet encryption at rest. Key rotation with grace periods. Never logged, masked for display
Automatic redaction of email, phone, SSN, credit card patterns in outputs
Opt-in only. Aggressive anonymization strips all secrets and user data
No PII in telemetry. Tenant data isolation. PII redaction in policy engine
Found a security issue? Please report it responsibly to security@sandcastle-ai.eu. We respond within 24 hours and aim to fix critical issues within 72 hours.