Compliance starts with
where the code runs.
OmniRun runs AI agent workloads in VM-isolated microVMs in the EU, inside your perimeter, with the egress posture you choose. Here is what we can and cannot claim — stated plainly.
Four controls, as they work today.
EU data residency
Sandboxes run in Hetzner data centers in Finland (EU). Your sandboxes and their files are stored there -- or on your own hardware if you self-host. Anything your code sends to outside services (including an LLM provider) goes wherever that service runs.
VM-grade isolation
Every workload runs in its own Firecracker microVM with a dedicated Linux kernel -- the isolation model behind AWS Lambda. There is no shared kernel between sandboxes; escaping the VM onto the host requires a bug in KVM or Firecracker, not just a guest kernel exploit.
Egress you control
Internet is on or off per sandbox. Base templates start offline, and internet: false keeps them with no route out at all; agent templates always have internet on, with open egress. For HTTPS, an opt-in SNI proxy limits a sandbox to an allowlist of hostnames. It does not filter other ports and is not proof against domain fronting, so treat it as a guard rail.
Scoped access
File upload/download URLs expire and are scoped to a single sandbox. Sandboxes are scoped to the creating user. Optional payload encryption to the worker (AES-256-GCM with ECDH P-256) adds a layer on top of TLS for commands, code, and file reads/writes; the worker decrypts it, so it is not end-to-end.
Programs & certifications
One honest caveat: Anthropic runs the model, so prompts and the conversation flow through Anthropic's API in every case. Self-hosting moves the tool execution into your perimeter; it does not move inference.
- Anthropic ZDR & HIPAA-BAA eligible. With Claude Managed Agents, Anthropic runs the model, so the prompt and conversation are governed by your Anthropic data agreement. That side is eligible for Anthropic's Zero-Data-Retention and HIPAA-BAA programs. This covers Anthropic's processing only. Self-hosting keeps the tool-call files and repos in your perimeter.
- EU-hosted (Hetzner). Infrastructure is in Finland, where sandboxes and their files are stored. For full control, run the same stack on your own hardware.
- No third-party certifications. OmniRun is not SOC 2, ISO 27001, or HIPAA certified. Our security model documents the isolation architecture and its known limitations instead.
Run agents where the rules require.
VM isolation, EU residency, and egress control — on your box or ours.