Deployment
Define the harnesses your agents run on. Every agent inherits one plan — host, runtime, network, secrets, and the governance guarantees you lock in.
3 plans
Standard — Azure / West US 2
Default harness for everyday personal agents.
- Host
- Microsoft Azure
- Region
- West US 2
- Runtime
- Decawork managed harness v1
- Compute
- 0.5 vCPU / 1 GB · autoscale 1–5
- Request timeout
- 60s
- Inbound
- Slack Socket Mode (no public ingress)
- Egress
- Gatehouse gateway only
- Secrets
- Brokered per call · none at rest
- Log retention
- 90 days
LOCKED GUARANTEES
Per-agent isolated sandboxAll tool calls auditedEgress via Gatehouse gateway onlyNo standing secrets on host
High-risk isolated — Azure / West Europe
Hardened harness for agents touching sensitive systems.
- Host
- Microsoft Azure
- Region
- West Europe
- Runtime
- Decawork isolated sandbox
- Compute
- 1 vCPU / 2 GB · autoscale 1–2
- Request timeout
- 30s
- Inbound
- None (outbound Socket Mode only)
- Egress
- Gateway only · default-deny all else
- Secrets
- Brokered per call · none at rest
- Log retention
- 1 year
LOCKED GUARANTEES
Per-agent isolated sandboxAll tool calls auditedEgress via Gatehouse gateway onlyNo standing secrets on hostHuman approval required for destructive verbs
Self-hosted — Customer VPC
Runs entirely inside the customer's own cloud.
- Host
- Self-hosted (customer VPC)
- Region
- Customer-defined
- Runtime
- Decawork managed harness v1
- Compute
- Customer-provisioned
- Request timeout
- 60s
- Inbound
- None (outbound Socket Mode only)
- Egress
- Gatehouse gateway only
- Secrets
- Customer KMS · none at rest
- Log retention
- Customer-defined
LOCKED GUARANTEES
Per-agent isolated sandboxAll tool calls auditedEgress via Gatehouse gateway onlyNo standing secrets on hostData never leaves the customer VPC