Security & Privacy

Craftly Cloud was built with a fundamental security rule: Your computer is your personal device first. Connecting your machine to the network must never compromise your private files, browsing data, credentials, or personal safety.

Strict Sandboxed Isolation

Every compute task executed on your computer runs inside a strictly isolated, unprivileged sandbox.

• Memory Isolation: Tasks run within their own isolated memory space. They cannot inspect, read, or alter memory belonging to other applications running on your machine.
• No Kernel Privilege: Craftly never requires root, kernel-level drivers, or administrator privileges to execute compute workloads.

Zero Access to Personal Files

The Craftly compute engine operates in a chrooted virtual scratch directory. It has strictly no read or write access to:

• Your Desktop, Documents, Downloads, or Pictures folders.
• Browser sessions, saved passwords, or cookie stores.
• Keyboards, mice, webcams, or microphone input streams.

Encrypted Network Communications

All communication between your node and the Craftly orchestrator uses TLS 1.3 encryption with mutual cryptographic certificate verification. No inbound ports or open firewall exceptions are ever opened on your router. Your machine only initiates outbound HTTPS/WSS connections, keeping your home or office local network invisible and secure from external scans.

Signed Binaries & Vetted Workloads

Craftly Cloud does not allow arbitrary, unverified code to run across the network. All workloads undergo static analysis and automated verification before distribution. Furthermore, all official Craftly Desktop client updates are cryptographically signed with validated developer certificates.