What we built to protect you,
in detail

Every line on this page comes from the RooF code running today, with its source. What we have not built yet, we say plainly.

An isolated computer per session

  • A separate container with fixed limits: 2 vCPU and 3 GB memory.1
  • No admin rights: all system capabilities dropped, escalation blocked and a process limit.2
  • The user inside the computer is not root.

Web-only network

  • A computer reaches the internet through web and DNS ports only.3
  • All internal and private networks are dropped; a computer cannot reach RooF’s own servers.
  • Every room gets its own private network that other rooms cannot see.4

A stream locked to your session

  • Every computer has a random password known only to the server.
  • The session token becomes an HttpOnly cookie scoped to your session path only.5
  • Supervisor links are view-only; the server drops any input from them.6

Protected accounts

  • Passwords are derived with scrypt and a per-account salt; never stored as typed.7
  • The sign-in cookie is signed, HttpOnly and Secure, so scripts cannot read it.
  • Limits on sign-in attempts and new accounts per connection.8

Data kept safe

  • Trials are wiped completely; RooF-Drive files stay until you delete them.
  • An integrity-checked backup every hour and a daily copy on a second server.9
  • Rotation moves old copies; it never deletes them.

Money

  • We store no card data: card payment is not live yet.
  • Every balance movement is a line in an append-only ledger with a key that prevents double charges.
  • Cash-out is off until a licensed payout partner exists.

Not built yet

  • Two-step verification (2FA) for customer accounts.
  • A published independent security audit, or a bug bounty programme.
  • A choice of data region.

Report a vulnerability

Found a security issue? Write to [email protected] with “Security” in the subject, and do not test it on other people’s accounts. We reply, fix and tell you.

Privacy policy

Your next computer isn’t at home

A full computer in seconds, with no card and nothing to install.

Try free for 3 minutesCreate account

Sources for these numbers

  1. Per-computer limits set by the RooF session orchestrator: 2 virtual CPUs and 3 GB of memory
  2. RooF session orchestrator: a 768-process limit, all system capabilities dropped (cap-drop ALL) and privilege escalation blocked (no-new-privileges)
  3. RooF firewall: a computer reaches the web only (ports 80, 443, 53) and no internal network
  4. RooF session orchestrator: every room gets its own private network; rooms cannot see each other
  5. The RooF server drops every key, mouse move and paste that comes from a supervisor link, even from a modified browser
  6. RooF account server: passwords are derived with scrypt and a random salt per account; they are never stored as typed
  7. RooF server: 20 sign-in attempts per connection per 15 minutes, and 5 new accounts per connection per hour
  8. RooF backup: an hourly copy, integrity-checked, newest 48 kept; a daily copy kept 30 days and copied to a second server; rotation moves files, never deletes