Where your code runs
Every DenkOps project runs on managed EU infrastructure, together with its disk, logs and secrets. There is no setting to forget and no US default to switch off.
What your agent can reach
- Default-deny egress. Outbound traffic is blocked until you allow a domain. A model that is tricked into exfiltrating data has nowhere to send it, see zero-trust egress for agents.
- Secrets it can use, not read. API keys live in environment variables; a scoped connection can deploy without being able to read them, see secrets agents can use, not see.
- Scoped, expiring tokens. Give each agent only the projects and permissions it needs, and revoke it in one click.
- Sign-in in front of connectors. OAuth with an allowed-email list, so only the right people reach a connector.
Who owns what
Workspaces have owners, members and viewers, with per-project roles on top. Every change is in the audit log. Read more on the security page.
Same price everywhere
One project is free. 5 always-on slots cost €39 per month, €5 per extra slot, billed in euros.