Local first
Files live on your device.
Your code stays yours
The machine runs on your own device. What syncs is encrypted in your browser. Agents work in a sandbox. Here is how each part works.
Your browserencrypts before uploadOur servers
- ~/.ssh/id_ed25519key→x9Fq…7Ld2
- ~/.bashrcdotfile→x9Fq…7Ld2
- ~/.bash_historyhistory→x9Fq…7Ld2
- ~/work/shop-apifiles→x9Fq…7Ld2
The key never leaves your browser. We store the right-hand column only.
The machine runs on your device
Your outpost is a Linux machine that runs inside your browser tab, on your own processor and memory. Your code is not executed on our servers.
- No server-side VM
- Files live in your browser’s storage
- Close the tab and nothing runs
$ uname -sm
Linux aarch64
running in this tab, on this computer
Your browserencrypts before uploadOur servers
- ~/.ssh/id_ed25519key→x9Fq…7Ld2
- ~/.bashrcdotfile→x9Fq…7Ld2
- ~/.bash_historyhistory→x9Fq…7Ld2
- ~/work/shop-apifiles→x9Fq…7Ld2
The key never leaves your browser. We store the right-hand column only.
End-to-end encryption for everything you sync
Workspaces, SSH keys, dotfiles and history are encrypted in your browser before they leave. Only your browser holds the key; we store ciphertext.
- Encrypted in the browser
- Decrypted only in the browser
- We cannot read it, so we cannot hand it over
Passkeys and a recovery key you hold
Sign in with a passkey on your laptop or phone. The key that decrypts your data is wrapped by your passkeys and by a recovery key only you keep, so no password can leak and we cannot reset your access.
- Passkeys with Touch ID or Face ID
- A recovery key printed once
- Remove a lost device in one click
Y
you0cloud.dev/you · member since November 2026
Sign-in methods
PasskeyMacBook Pro, Touch IDPrimary
PasskeyiPhone, Face IDActive
GitHubLinked for sign-in and reposLinked
Recovery key
•••••• •••••• •••••• •••••• •••••• ••••••
The only way back into your encrypted data if you lose every device. We cannot reset it for you.
Plan
FreeThe outpost runs on your deviceActive
Relay
1.2 GB this monthNo monthly cap. Fair use at 10 Mbps.Normal
Products on this account
0cloud4 workspacesIn use
Edixedix.sh/you, 2 private reposIn use
arm644 vCPU1 GBDebian 13end-to-end encryptedrelay connected
$ claude --dangerously-skip-permissions
● Rebuilt the database.
snapshot from 10:02 available
A sandbox for agents
Coding agents in full-auto mode work inside the outpost, a separate machine. They cannot reach your computer’s files, and a snapshot lets you roll back any task.
- Separate machine per workspace
- Snapshots before risky work
- Bubblewrap works inside
Previews on their own domain
Code you run inside the outpost is served on 0cloud.run, a separate domain from your account on 0cloud.dev. A page you preview can never read your sign-in.
- Account on 0cloud.dev
- Your code on 0cloud.run
- No sign-in cookie on 0cloud.run
account: 0cloud.dev
previews: k3x9-5173.0cloud.run
no shared cookies
Trust, point by point
Your keys
Private keys never reach the page.
Encrypted transport
HTTPS, SSH and git stay encrypted through the relay.
Real isolation
A whole machine per workspace.
Open base
Debian and Linux, as shipped.
Browser sandbox
The tab runs inside the browser’s own sandbox.
Questions
Can 0cloud employees see my code?
No. Your code runs on your device, and what syncs is encrypted with a key only your browser holds.
What passes through the relay?
Network traffic from your outpost. HTTPS, SSH and git connections stay encrypted end to end.
Where is my data stored?
In your browser’s storage on your device. Synced copies are stored encrypted.