Security isn't a feature. It's the foundation.

Every KiwiClaw agent runs in its own isolated container with a dedicated filesystem and workspace — separate from other tenants.

Your agent's data, configuration, and conversation history are scoped to that tenant and are not shared with any other tenant.

Browser automation and code execution run inside your agent's own container, under kernel-level sandboxing (gVisor) for defense in depth. If your agent runs a script or drives a headless browser, it happens in an environment scoped to your agent.

The execution environment is disposable and contained. No sandbox is unbreakable, so we pair it with capability and egress controls rather than claiming isolation is absolute.

341 malicious skills have been found in the OpenClaw ecosystem. Skills that exfiltrate data, install backdoors, or run cryptominers. If you self-host, you're on your own to vet them.

Marketplace publication uses an administrative submission and approval workflow. It is not a security certification and does not replace review of the publisher, code, permissions, credentials, and network access before installation.

Public traffic and managed database connections use TLS. Provider credentials supplied by BYOK users are encrypted with AES-256-GCM before database storage and are decrypted only for authenticated runtime configuration.

Tenant runtime files live on persistent host storage. KiwiClaw does not currently make a blanket encryption-at-rest claim for every runtime file.

Managed LLM users never see or handle API keys at all. Their requests are authenticated via per-tenant JWTs and routed through our internal LLM proxy. Pooled API keys live only in the proxy and are never exposed to tenant machines.

BYOK is the exception: your own provider key is placed in your own container so your agent can call your provider account directly. How the credential flow works, and what it does and doesn't cover.

KiwiClaw records application audit events for account, agent, configuration, and administrative activity. Audit views and export endpoints are available.

The current audit store is not an immutable write-once ledger and does not include turnkey SIEM delivery, customer-configurable retention, or compliance-ready evidence packages.

Enterprise teams get RBAC with granular permissions. Admins configure agents and skills. Members can chat and use the agent. Viewers can read conversation history but not interact.

Invite teammates, assign roles, control who can do what. No more sharing a single login or worrying about interns accidentally reconfiguring the agent.

Production tenant workloads currently run in Falkenstein, Germany. Customer-selectable US, EU, or APAC regions are not generally available.

Control-plane vendors and LLM providers may process data in other locations under their own terms. Request the current data-flow and subprocessor picture before sending regulated data.

KiwiClaw is not SOC 2 certified, does not sign HIPAA BAAs, does not currently offer a standard DPA, and does not claim that a customer's use is GDPR compliant.

The team can document the technical controls that are live today, but your organization must complete its own legal, security, and vendor-risk review.