{
 "features_resolved": {
  "snapshot_any": true,
  "snapshot_mem": false,
  "fork": true,
  "pause_resume": true,
  "persistent_disk": true,
  "whole_disk": null,
  "persist_scope": null,
  "volumes": true,
  "auto_stop_idle": true,
  "long_sessions": true,
  "custom_image": true,
  "image_snapshot": true,
  "image_oci": true,
  "vm_isolation": false,
  "docker_inside": true,
  "nested_virt": false,
  "root": true,
  "systemd": null,
  "browser": true,
  "desktop": true,
  "computer_use": false,
  "code_interpreter": false,
  "browser_control": null,
  "desktop_control": null,
  "browser_and_desktop": false,
  "anti_bot": false,
  "captcha_solving": false,
  "residential_ip": false,
  "agent_harnesses": true,
  "ssh": true,
  "public_ipv4": false,
  "inbound_https": true,
  "custom_domain": false,
  "raw_tcp_inbound": false,
  "egress_allowlist": false,
  "open_internet": null,
  "static_egress_ip": false,
  "private_network": null,
  "self_host": true,
  "byoc": true,
  "open_source": true,
  "soc2": true,
  "hipaa": true,
  "sso": true,
  "gpu": true,
  "arm64": true,
  "windows": true,
  "macos": false,
  "lang_python": true,
  "lang_node": false,
  "lang_go": null,
  "lang_rust": null,
  "lang_java": null,
  "gpu_desktop": true,
  "credential_injection": null,
  "egress_http_rules": false,
  "wake_on_request": false,
  "live_resize": false,
  "fork_running": true,
  "memory_snapshot_fork": false,
  "webhooks": null,
  "scheduled_wakeups": null,
  "audit_logs": null,
  "eu_data_residency": true,
  "zero_data_retention": null,
  "scoped_api_keys": null,
  "spend_limits": null,
  "mcp_server": false,
  "usage_api": false,
  "snapshot_auto": false,
  "snapshot_on_demand": true,
  "harness_api": false,
  "own_agent_api": false,
  "fast_boot": null,
  "strong_isolation": false,
  "ingress_rules": true,
  "guest_firewall": false,
  "secret_proxy": false,
  "secret_proxy_any": false,
  "volume_attach": true,
  "volume_shared": true,
  "sidecar": null,
  "fuse": null,
  "kernel_features": null,
  "burst": null
 },
 "company": {
  "id": "kasm-workspaces",
  "checked": "2026-09-30",
  "company": "Kasm Technologies, Inc.",
  "ownership": {
   "value": "independent",
   "parent": null,
   "source": "https://kasmweb.com/about",
   "quote": "Kasm Technologies and its founders saw an opportunity to democratize those safeguards... Kasm was founded to continue to serve in that mission, for government agencies, for commercial markets, and for the open-source community."
  },
  "stage": {
   "value": "bootstrapped",
   "source": "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&company=kasm&type=D",
   "quote": "No matching companies.",
   "confidence": "low",
   "note": "No SEC Form D filing, no Crunchbase/Tracxn/PitchBook profile accessible, no press release or news coverage of any priced funding round, and no investor names found anywhere; the company's own About page credits only its founders (ex-DOD/federal background) with starting it, never investors. Absence of any funding announcement across a 10-year-old, actively-hiring company is itself suggestive of bootstrapping, but this is inferred, not confirmed by a direct statement, so confidence is low."
  },
  "accelerators": [],
  "total_funding_usd": {
   "value": null,
   "status": "unknown"
  },
  "last_round": {
   "type": "unknown",
   "amount_usd": null,
   "date": null,
   "leads": [],
   "status": "unknown",
   "source": "",
   "quote": ""
  },
  "investors": [],
  "portfolio_listings": [],
  "revenue": {
   "value": null,
   "status": "unknown"
  },
  "employees": {
   "value": null,
   "source": ""
  },
  "note": "Kasm Technologies (maker of Kasm Workspaces) is headquartered in McLean, Virginia, founded by ex-US federal/DoD-focused engineers (Justin Travis, CEO; Matt McClaskey, CTO) per its own About page. No evidence of any external VC financing was found: no SEC Form D, no accessible Crunchbase/Tracxn/PitchBook record, no TechCrunch/press coverage of a raise, and no investor names surface anywhere searched. This is consistent with a bootstrapped/self-funded private company, but no source explicitly confirms 'bootstrapped' or states revenue/funding figures, so those fields are left unknown rather than guessed."
 },
 "id": "kasm-workspaces",
 "name": "Kasm Workspaces",
 "url": "https://kasm.com/community-edition",
 "category": "dev-env",
 "isolation": "container",
 "modes": [
  {
   "key": "self-host-licence",
   "label": "Self-hosted Workspaces licence (Starter: $10/user or $20/concurrent session)",
   "flags": [
    "alt",
    "commit"
   ],
   "os": [
    "linux"
   ],
   "pricing": "sizes",
   "vcpu_h": null,
   "ram_gib_h": null,
   "cpu_basis": "alloc",
   "ram_basis": "alloc",
   "active_floor": 0,
   "ram_per_vcpu": [
    null,
    null
   ],
   "ram_fixed_per_vcpu": null,
   "vcpu_options": null,
   "min_vcpu": null,
   "max_vcpu": null,
   "max_ram_gib": null,
   "sizes": [
    {
     "name": "Starter licence (compute on your own servers)",
     "vcpu": null,
     "ram_gib": null,
     "disk_gib": null,
     "hour": null,
     "month_cap": null
    }
   ],
   "pool_tiers": null,
   "requires_always_on": false,
   "always_on_month_per_instance": null,
   "commit_note": "Annual licence subscription billed upfront; $120/named user/yr or $240/concurrent session/yr; checkout caps at 25 seats.",
   "min_billed_seconds": 0,
   "granularity_s": 1,
   "start_fee": 0,
   "boot_overhead_s": null,
   "multiplier": 1,
   "windows_vcpu_h": null,
   "gpu": null,
   "features": {},
   "note": "Starter licence = $10 per named user per month or $20 per concurrent session per month, sold only as an annual subscription billed upfront ($120/user/yr or $240/session/yr), 1-25 seats via online checkout (Starter version only; >25 = Enterprise quote). Self-supported (no support); support add-on 20% (Standard) / 40% (Premium) of licence cost; PureVPN egress add-on $8/seat/month. Compute is your own servers/cloud on top. hour stays null because the licence is per seat, not per hour.",
   "regions": null
  },
  {
   "key": "kasm-hosted-saas",
   "label": "Kasm-managed Workspaces as a Service (minimum 25 users)",
   "flags": [
    "sales"
   ],
   "os": [
    "linux"
   ],
   "pricing": "sizes",
   "vcpu_h": null,
   "ram_gib_h": null,
   "cpu_basis": "alloc",
   "ram_basis": "alloc",
   "active_floor": 0,
   "ram_per_vcpu": [
    null,
    null
   ],
   "ram_fixed_per_vcpu": null,
   "vcpu_options": null,
   "min_vcpu": null,
   "max_vcpu": null,
   "max_ram_gib": null,
   "sizes": [
    {
     "name": "Kasm hosted SaaS (quote)",
     "vcpu": null,
     "ram_gib": null,
     "disk_gib": null,
     "hour": null,
     "month_cap": null
    }
   ],
   "pool_tiers": null,
   "requires_always_on": false,
   "always_on_month_per_instance": null,
   "commit_note": null,
   "min_billed_seconds": 0,
   "granularity_s": 1,
   "start_fee": 0,
   "boot_overhead_s": null,
   "multiplier": 1,
   "windows_vcpu_h": null,
   "gpu": null,
   "features": {},
   "note": "Added 2026-09-28 (missing-providers audit). https://kasm.com/cloud-vs-server: \"Cloud Kasm-Managed - Minimum of 25 users\", Workspaces as a Service; Kasm Hosted SaaS is an Enterprise feature (https://kasm.com/community-edition), price by quote.",
   "regions": null
  },
  {
   "key": "cloud-personal",
   "label": "Kasm Cloud Personal (hosted disposable browser/desktop, flat monthly with hour cap)",
   "flags": [
    "alt"
   ],
   "os": [
    "linux"
   ],
   "regions": null,
   "pricing": "pool",
   "pool_tiers": [
    {
     "name": "Cloud Browser",
     "month": 10,
     "vcpu": 1,
     "ram_gib": 2,
     "max_vms": null
    },
    {
     "name": "Cloud Desktop",
     "month": 20,
     "vcpu": 2,
     "ram_gib": 4,
     "max_vms": null
    },
    {
     "name": "Cloud OSINT",
     "month": 40,
     "vcpu": 2,
     "ram_gib": 4,
     "max_vms": null
    }
   ],
   "features": {
    "root": false,
    "persistent_disk": false,
    "volumes": false,
    "custom_image": false,
    "docker_inside": false,
    "auto_stop_idle": true
   },
   "min_billed_seconds": 0,
   "granularity_s": 1,
   "start_fee": 0,
   "note": "Self-serve monthly subscription, no annual option shown. Hours are hard monthly caps: Browser 100 h (20-min idle timeout), Desktop 200 h (30-min idle timeout), OSINT 300 h (60-min idle timeout); no overage price published. vCPU is a minimum with burst allowed; RAM is a hard limit. Sessions are deleted after use, no software installs, no root, no persistence (link Dropbox/OneDrive/Google Drive instead). Concurrent sessions per account not published (max_vms null). Purchases non-refundable; cancel at end of term (Cloud SaaS terms). Alt: consumer isolation product, not a programmable sandbox.",
   "cpu_class": "shared"
  }
 ],
 "storage": {
  "included_disk_gib": 0,
  "disk_gib_month": null,
  "disk_billed_when_stopped": false,
  "snapshot_gib_month": null,
  "paused_ram_billed": false
 },
 "network": {
  "egress_free_gib": null,
  "egress_gib": null,
  "ipv4_month": null,
  "ipv4_available": false
 },
 "plans": [
  {
   "name": "Starter (self-host)",
   "fee": 10,
   "flags": [
    "alt",
    "commit"
   ],
   "fee_is_credit": false,
   "included_usd": 0,
   "per_seat": 10,
   "waives_start_fee": false,
   "included_applies_to_modes": null,
   "concurrency": 25,
   "max_session_h": null,
   "max_vcpu": null,
   "max_ram_gib": null,
   "sizes_allowed": null,
   "note": "$10/named user/month or $20/concurrent session/month, billed annually upfront; 1-25 seats; self-supported only (no support tickets); support add-on 20%/40% of licence; PureVPN egress $8/seat/month optional; compute not included."
  },
  {
   "name": "Enterprise / Kasm hosted",
   "fee": null,
   "flags": [
    "sales"
   ],
   "fee_is_credit": false,
   "included_usd": 0,
   "per_seat": 0,
   "waives_start_fee": false,
   "included_applies_to_modes": null,
   "concurrency": null,
   "max_session_h": null,
   "max_vcpu": null,
   "max_ram_gib": null,
   "sizes_allowed": null,
   "note": "Request a quote; Kasm-managed cloud: minimum 25 users, per-user annual cloud subscription, single-tenant; HA only for 100+ users. (Cloud Personal FAQ says SaaS instances for 'businesses with 50 or more uses' - older doc, conflicts with 25.)"
  },
  {
   "name": "Community Edition (self-host)",
   "fee": 0,
   "flags": [
    "alt"
   ],
   "fee_is_credit": false,
   "included_usd": 0,
   "per_seat": 0,
   "waives_start_fee": false,
   "included_applies_to_modes": [
    "self-host-licence"
   ],
   "concurrency": 5,
   "max_session_h": null,
   "max_vcpu": null,
   "max_ram_gib": null,
   "sizes_allowed": null,
   "note": "Free, non-commercial only (individuals, non-profits, testing); 5 concurrent sessions; community support; compute is your own."
  }
 ],
 "free": {
  "monthly_credit": 0,
  "one_time_credit": 0
 },
 "price_expires": null,
 "features": {
  "linux": true,
  "windows": true,
  "macos": false,
  "arm64": true,
  "gpu": true,
  "gpu_types": [],
  "snapshot": "fs",
  "pause_resume": true,
  "fork": true,
  "persistent_disk": true,
  "volumes": true,
  "auto_stop_idle": true,
  "max_session_h": null,
  "custom_image": true,
  "docker_inside": true,
  "nested_virt": false,
  "root": true,
  "systemd": null,
  "browser": true,
  "desktop": true,
  "computer_use": false,
  "code_interpreter": false,
  "agent_harnesses": true,
  "ssh": true,
  "public_ipv4": false,
  "inbound_https": true,
  "custom_domain": false,
  "raw_tcp_inbound": false,
  "egress_allowlist": false,
  "static_egress_ip": false,
  "private_network": null,
  "self_host": true,
  "byoc": true,
  "open_source": true,
  "regions": [
   "us",
   "eu",
   "asia",
   "other"
  ],
  "soc2": true,
  "hipaa": true,
  "sso": true,
  "lang_python": true,
  "lang_node": false,
  "lang_go": null,
  "lang_rust": null,
  "lang_java": null,
  "gpu_desktop": true,
  "credential_injection": null,
  "egress_http_rules": false,
  "wake_on_request": false,
  "live_resize": false,
  "fork_running": true,
  "memory_snapshot_fork": false,
  "webhooks": null,
  "scheduled_wakeups": null,
  "audit_logs": null,
  "eu_data_residency": true,
  "zero_data_retention": null,
  "scoped_api_keys": null,
  "spend_limits": null,
  "mcp_server": false,
  "snapshot_auto": false,
  "snapshot_on_demand": true,
  "harness_api": false,
  "ingress_rules": true,
  "secret_proxy": false,
  "volume_attach": true,
  "volume_shared": true,
  "isolation": "container",
  "image_oci": true,
  "anti_bot": false,
  "captcha_solving": false,
  "egress_ip_type": "datacenter",
  "own_agent_api": false,
  "guest_firewall": false,
  "max_session_unlimited": true,
  "usage_api": false
 },
 "perf": {
  "cpu_runs_s": null,
  "cold_start_ms": null,
  "burst_tti_ms": null,
  "dax_s": null
 },
 "perf_source": "No benchmark row: provider is not in ComputeSDK results or the HPC run (as of 2026-09-28). See research/perf-map.json.",
 "knobs": [],
 "caveats": [
  "Starter self-host licence is $10/named user/month or $20/concurrent session/month on an annual prepaid subscription (1-25 seats) plus your own compute; hosted business SaaS is quote-only (min 25 users, annual). The only self-serve Kasm-hosted compute is Cloud Personal ($10/$20/$40 per month with 100/200/300 h caps).",
  "Self-hosted: compute is your own servers or cloud VMs, on top of the licence.",
  "Community Edition is free for individuals/non-profits (5 concurrent sessions), non-commercial.",
  "Streams containerised Linux desktops/browsers (KasmVNC); Windows via RDP servers.",
  "Kasm also sells Workspaces for Oracle Click-to-Subscribe (ephemeral workspaces on OCI, no persistence): Developer $40, Business $60, AI (GPU) $250 per user/month with 200/200/240 h monthly caps and 30/30/60-min idle timeouts. Machine sizes are not published, so it is not priced."
 ],
 "sources": [
  "https://kasm.com/community-edition",
  "https://kasm.com/cloud-vs-server",
  "https://kasm.com/docs/latest/license.html"
 ],
 "audit_2026_09_29": {
  "applied": 19,
  "source": "checked against the provider's live pricing and docs pages",
  "reviewed": 4
 },
 "feature_evidence": {
  "snapshot_auto": {
   "value": false,
   "source": "https://kasm.com/docs/latest/guide/sessions.html",
   "quote": "Stop - The session is stopped, preserving the disk state.",
   "note": "No automatic snapshot. keepalive_expiration_action (group setting; default timeout 1 h) can delete, stop (container disk kept = persistent disk, processes lost) or pause (docker pause: 'preserving the disk,  process and memory state' but it stays in RAM/swap, not checkpointed). Persistent profiles (host/NFS volume or S3 via kasm-profile-sync) restore only the user's home directory on each launch.",
   "checked": "2026-09-29"
  },
  "snapshot_on_demand": {
   "value": true,
   "source": "https://kasm.com/docs/latest/guide/sessions.html",
   "quote": "Administrators can create new docker images from active container-based Workspace sessions.",
   "note": "'Create Image from Session' in the admin Sessions page = docker commit of the running container (disk only, no memory), optional push to a registry; a new Workspace entry is created so new sessions boot from it (template-style fork). Admin console only; not in the public Developer API endpoint list. Container workspaces only.",
   "checked": "2026-09-29"
  },
  "harness_api": {
   "value": false,
   "source": "https://kasm.com/docs/latest/developers/developer_api.html",
   "quote": null,
   "note": "Public Developer API covers request_kasm/destroy_kasm/exec_command_kasm (generic exec), screenshots, users, egress, casting, staging; no agent-harness endpoints. 1.17 only adds a 'Kasm AI registry' spotlight entry (images). Latest docs are 1.17.0.",
   "checked": "2026-09-29"
  },
  "egress_allowlist": {
   "value": false,
   "source": "https://kasm.com/docs/latest/guide/web_filtering.html",
   "quote": "If checked, all requests will be denied unless the domain is added to the Domain Whitelist, or the category of the domain is set to allow.",
   "note": "Web Filter Policies (domain allow/deny lists, deny-by-default, URL categories, per group/workspace) exist, but they are enforced by a Kasm Squid proxy installed inside the workspace image and wired via http_proxy=127.0.0.1:3128 (workspaces-core-images install_squid.sh), i.e. inside the container, not outside it. Other network controls: Egress Providers/Gateways tunnel all session traffic through OpenVPN/WireGuard (routing, with kill-switch iptables in the container netns, not an allowlist); admins can pin workspaces to custom Docker networks on self-managed agents (host firewall is the operator's own).",
   "checked": "2026-09-29"
  },
  "ingress_rules": {
   "value": true,
   "source": "https://kasm.com/docs/latest/guide/session_sharing.html",
   "quote": "Any authenticated user may join a shared session if the URL is known.",
   "note": "Sessions are only reachable as streamed desktops through the authenticated Kasm web/proxy tier; sharing is opt-in (allow_kasm_sharing group setting), view-only by default; Casting URLs can be unauthenticated but protected by ReCAPTCHA, referrer and per-IP rate limits. No feature for publishing arbitrary app ports; no per-session IP allowlist documented.",
   "checked": "2026-09-29"
  },
  "secret_proxy": {
   "value": false,
   "source": "https://kasm.com/docs/latest/developers/developer_api.html",
   "quote": "environment* dict: Optional environmental variables to inject into the created container.",
   "note": "Secrets reach sessions only as plain environment variables (request_kasm 'environment') or files/mounted storage; no first-party HTTP proxy that injects credentials on the wire for outbound API calls was found in the developer API, egress/VPN, or storage-mapping docs. Matches the card's own prior feature_evidence entry for secret_proxy.",
   "checked": "2026-09-30"
  },
  "volume_attach": {
   "value": true,
   "source": "https://kasm.com/docs/latest/guide/storage_mappings.html",
   "quote": "Storage Mappings allow administrators to create and attach custom and ephemeral docker volumes in Kasm Workspace Containers.",
   "note": "Also Volume Mappings (host/NFS paths bound into every session of a workspace) and user cloud-storage mappings (Google Drive, Dropbox, OneDrive, Nextcloud, S3, rclone).",
   "checked": "2026-09-29"
  },
  "volume_shared": {
   "value": true,
   "source": "https://kasm.com/docs/latest/guide/persistent_data/volume_mapping.html",
   "quote": "This effectively will act as a file share.",
   "note": "A host directory (NFS/SMB/etc. in multi-server deployments) mapped into all concurrent sessions of the workspace, mode rw or ro per mapping; {username}/{user_id}/{image_id} tokens give per-user paths.",
   "checked": "2026-09-29"
  },
  "isolation": {
   "value": "container",
   "source": "https://kasm.com/docs/latest/guide/sessions.html",
   "quote": "This action is valid for container-based sessions only.",
   "note": "Kasm Workspaces sessions are Docker containers (KasmVNC-streamed); Windows sessions are separate RDP-connected VMs/hosts, not the isolation unit of the product itself.",
   "checked": "2026-09-30"
  },
  "image_oci": {
   "value": true,
   "source": "https://kasm.com/community-edition",
   "quote": "Custom Images",
   "note": "Workspaces launch from Docker images (Kasm's own workspaces-core-images library or any custom Docker image built on top); admins add/build custom images via the Admin console, confirming the docs feature matrix and card's existing custom_image=true.",
   "checked": "2026-09-30"
  },
  "nested_virt": {
   "value": false,
   "source": "https://hub.docker.com/v2/repositories/kasmweb/",
   "quote": "ubuntu-focal-dind, ubuntu-jammy-dind, ubuntu-bionic-dind",
   "note": "Kasm ships Docker-in-Docker (dind) workspace images for nested containers, but no documentation mentions /dev/kvm passthrough or nested hardware virtualization into a session; container-based sessions do not expose KVM by default. Marked false as 'derived' from the container isolation model.",
   "checked": "2026-09-30"
  },
  "anti_bot": {
   "value": false,
   "source": "https://kasm.com/community-edition",
   "quote": "Kasm Workspaces Community Edition (CE) is a free, full-featured version of our container streaming platform—built for individual users, non-profit organizations, non-commercial use.",
   "note": "not offered: outside the product's scope. Kasm is a remote browser/desktop isolation and streaming platform for security/compliance use cases, not a scraping/automation stealth or anti-fingerprinting product.",
   "checked": "2026-09-30"
  },
  "captcha_solving": {
   "value": false,
   "source": "https://kasm.com/community-edition",
   "quote": "Kasm Workspaces Community Edition (CE) is a free, full-featured version of our container streaming platform.",
   "note": "not offered: outside the product's scope. The only CAPTCHA usage found in docs is Kasm itself using reCAPTCHA to protect unauthenticated Casting URLs, not a service that solves CAPTCHAs for the user.",
   "checked": "2026-09-30"
  },
  "egress_ip_type": {
   "value": "datacenter",
   "source": "https://kasm.com/cloud-vs-server",
   "quote": "Host Kasm Workspaces on your own infrastructure in your on-premise data center or in your Cloud Service Provider VPC.",
   "note": "Self-hosted product: default egress is whatever datacenter/cloud VPC the customer deploys on. An optional PureVPN Managed Egress add-on can route traffic through 80+ VPN gateway locations, but that is a shared VPN exit, not a distinct base egress IP type.",
   "checked": "2026-09-30"
  },
  "ssh": {
   "value": true,
   "source": "https://kasm.com/docs/latest/FAQ.html",
   "quote": "Kasm Workspaces supports session handling and rendering for arbitrary systems that support RDP, VNC, SSH, or KasmVNC.",
   "note": "Kasm can stream/proxy an SSH terminal session (with tmux/screen recommended for resuming work) as a Workspace connection type, in addition to container/VNC/RDP sessions.",
   "checked": "2026-09-30"
  },
  "own_agent_api": {
   "value": false,
   "source": "https://kasm.com/docs/latest/developers/developer_api.html",
   "quote": "The Kasm Workspaces Developer API can be leveraged to extend the systems functionality and/or integrate with an exiting platform. Integrators interface with the API to create and manage sessions, users and groups.",
   "note": "The Developer API manages sessions/users/screenshots/exec-command; there is no first-party API that drives Kasm's own browser/computer-use/research task agent. A 'KasmGPT' doc page exists but is empty/unpublished with no discoverable API surface.",
   "checked": "2026-09-30"
  },
  "lang_python": {
   "value": true,
   "source": "https://hub.docker.com/v2/repositories/kasmweb/",
   "quote": "core-ubuntu-focal, core-ubuntu-jammy, core-debian-bullseye, core-alpine-317 ...",
   "note": "derived: Workspace images are standard Ubuntu/Debian/Alpine/Fedora bases where python3 is part of the default OS package set; no python-specific dev image is advertised but the interpreter is present out of the box on the mainstream base images and root access lets you install any version.",
   "checked": "2026-09-30"
  },
  "lang_node": {
   "value": false,
   "source": "https://hub.docker.com/v2/repositories/kasmweb/",
   "quote": "desktop, vs-code, java-dev, core-ubuntu-jammy ...",
   "note": "derived: no Node.js-specific runtime or dev image is listed among Kasm's published workspace images (only a java-dev coding image); Node is not part of the default Ubuntu/Debian base install, so it is not available out of the box (root access lets you add it yourself via a custom image).",
   "checked": "2026-09-30"
  },
  "egress_http_rules": {
   "value": false,
   "source": "https://kasm.com/docs/latest/guide/web_filtering.html",
   "quote": "If checked, all requests will be denied unless the domain is added to the Domain Whitelist, or the category of the domain is set to allow.",
   "note": "Web Filter Policies operate at the domain/category level (allow/deny lists) via an in-workspace Squid proxy; no HTTP method/path-level egress rule engine is documented.",
   "checked": "2026-09-30"
  },
  "guest_firewall": {
   "value": false,
   "source": "https://kasm.com/docs/latest/guide/sessions.html",
   "quote": "This action is valid for container-based sessions only.",
   "note": "derived: Kasm sessions are containers (not full VMs), and Docker containers do not get iptables/nftables-capable network namespaces (CAP_NET_ADMIN) by default; no documentation shows guest-side firewall rules being supported inside a Workspace container.",
   "checked": "2026-09-30"
  },
  "static_egress_ip": {
   "value": false,
   "source": "https://kasm.com/docs/latest/guide/egress.html",
   "quote": "Kasm Workspaces allows for the Kasm Administrator to define an Egress Provider, which contains a collection of Egress Gateways that can be selected upon Workspace launch to tunnel all of a Workspace's network traffic.",
   "note": "Egress is via shared, admin-configured VPN gateways (OpenVPN/WireGuard, or the PureVPN-managed pool of 80+ locations) selected per session, not a dedicated fixed outbound IP assigned to one customer/session.",
   "checked": "2026-09-30"
  },
  "hipaa": {
   "value": true,
   "source": "https://kasm.com/compliance",
   "quote": "Kasm Workspaces provides a secure browser isolation & remote access platform designed to help healthcare organizations protect PHI & support HIPAA compliance initiatives. ... Kasm provides the platform that enables HIPAA compliance. Certification depends on how your IT and security teams implement and manage controls within your environment.",
   "note": "Self-hosted architecture: Kasm itself does not process customer PHI (customer controls the deployment/infra), so there is no traditional BAA-with-Kasm cloud service; the vendor explicitly markets the platform as HIPAA-compliance-enabling when deployed and configured correctly by the customer.",
   "checked": "2026-09-30"
  },
  "eu_data_residency": {
   "value": true,
   "source": "https://kasm.com/cloud-vs-server",
   "quote": "Full control of the location, security and access to your data for regulatory compliance.",
   "note": "Self-hosted/BYOC product: customer chooses the deployment region (on-prem or any cloud VPC, including EU regions), giving full control over data residency; matches the card's existing regions list including 'eu'.",
   "checked": "2026-09-30"
  },
  "max_session_h": {
   "value": "none",
   "source": "https://kasm.com/docs/latest/guide/groups.html",
   "quote": "session_time_limit — The amount of time (in seconds) a session will automatically expire.",
   "note": "There is no platform-enforced maximum session length; session_time_limit, keepalive_expiration and usage_limit are all optional, admin-configured group settings (unset by default except a 1h idle keepalive_expiration), so a session can run indefinitely until the admin configures a limit or stops it.",
   "checked": "2026-09-30"
  },
  "fork": {
   "value": true,
   "corrected_from": false,
   "source": "https://kasm.com/docs/latest/guide/sessions.html",
   "quote": "Administrators can create new docker images from active container-based Workspace sessions. ... A Workspace entry is automatically created and presented to the Administrator for additional configurations.",
   "note": "'Create Image from Session' (docker commit of a session's disk state) produces a new Workspace/image that new sessions boot from - a disk-level clone/fork mechanism. Admin console only, container Workspaces only, disk state only (no memory).",
   "checked": "2026-09-30"
  },
  "fork_running": {
   "value": true,
   "corrected_from": false,
   "source": "https://kasm.com/docs/latest/guide/sessions.html",
   "quote": "Administrators can create new docker images from active container-based Workspace sessions.",
   "note": "The docs explicitly say the session being cloned is 'active' (running); the source session is not stopped to take the image. Only disk state is captured, so combined with memory_snapshot_fork=false this is a running-container-to-template fork, not a live memory-preserving clone.",
   "checked": "2026-09-30"
  },
  "memory_snapshot_fork": {
   "value": false,
   "source": "https://kasm.com/docs/latest/guide/sessions.html",
   "quote": "A task will be sent to the Kasm Agent, to conduct a docker commit with the new image",
   "note": "docker commit only captures filesystem/disk state, not the running process/memory state, so clones from a session never carry forward running processes. Consistent with the card's existing snapshot_auto note that pause 'preserving the disk, process and memory state' keeps it in RAM/swap rather than checkpointing into a portable fork.",
   "checked": "2026-09-30"
  },
  "computer_use": {
   "value": false,
   "source": "https://kasm.com/docs/latest/developers/developer_api.html",
   "quote": "Gets a screenshot of the requested session.",
   "note": "The public Developer API only exposes get_kasm_screenshot (image), exec_command_kasm (shell exec), stats, and session lifecycle calls; there is no endpoint to inject mouse/keyboard input (only human end-users interact live via the KasmVNC websocket in a real browser session). No screenshot+click driving API found.",
   "checked": "2026-09-30"
  },
  "wake_on_request": {
   "value": false,
   "source": "https://kasm.com/docs/latest/guide/sessions.html",
   "quote": "Start - Re-start a stopped or paused session.",
   "note": "Stopped/paused sessions require an explicit admin/API 'Start' action to resume; request_kasm (developer_api.html) always requests/creates a session rather than auto-waking an existing stopped one. No documented mechanism that wakes a stopped session automatically when a request/connection arrives.",
   "checked": "2026-09-30"
  },
  "public_ipv4": {
   "value": false,
   "source": "https://kasm.com/",
   "quote": "Kasm Workspaces | The Container Streaming Platform ... delivers zero-trust remote browser isolation (RBI), desktop as a service (DaaS) and open-source intelligence (OSINT) workloads to the web browser.",
   "note": "Kasm is a container streaming platform: sessions run as Docker containers reached only via the Kasm web/proxy tier (KasmVNC over the Kasm server's HTTPS endpoint), not given a routable public IPv4 of their own. No per-session public IPv4 feature is documented anywhere in the developer API or session docs.",
   "checked": "2026-09-30"
  },
  "agent_harnesses": {
   "value": true,
   "corrected_from": false,
   "source": "https://github.com/kasmtech/workspace-ai-images",
   "quote": "dockerfile-kasm-claude-code",
   "note": "Kasm's official workspace-ai-images repo ships ready-made Workspace images/Dockerfiles that install Claude Code, Codex CLI, Gemini CLI, and Cursor (dockerfile-kasm-claude-code, dockerfile-kasm-codex-cli, dockerfile-kasm-gemini-cli, dockerfile-kasm-cursor, dockerfile-kasm-ubuntu-agentic), each running an install_claude.sh-style script inside a Kasm base image so the coding agent is preinstalled/offered as a launchable Workspace template.",
   "checked": "2026-09-30"
  },
  "mcp_server": {
   "value": false,
   "source": "https://api.github.com/orgs/kasmtech/repos",
   "quote": "(no repository named mcp, mcp-server, or similar in the kasmtech GitHub org's ~40 public repos)",
   "note": "Kasm ships a REST Developer API (developer_api.html) but no first-party MCP server for controlling Kasm Workspaces was found in the kasmtech GitHub org, the docs site, or Kasm's blog/product pages.",
   "checked": "2026-09-30"
  },
  "macos": {
   "value": false,
   "source": "https://github.com/kasmtech/workspaces-images",
   "quote": "Kasm Workspaces | The Container Streaming Platform ... Library of open-source Workspace browser, desktop and application images. Hosted on dockerhub and github, including Ubuntu, CentOS, SUSE & Kali.",
   "note": "Kasm's container/desktop image library (workspaces-images, workspaces-core-images) is Linux-only (Ubuntu/CentOS/SUSE/Kali base images) with Windows reachable only via RDP passthrough servers; there is no macOS guest/image offering (containers share a Linux kernel, so a macOS guest is not technically offered). Plainly outside the product's isolation model.",
   "checked": "2026-09-30"
  },
  "live_resize": {
   "value": false,
   "source": "https://kasm.com/docs/latest/guide/workspaces.html",
   "quote": "Cores: Amount of CPU cores allocated per Workspace. Memory: Amount of Memory allocated per Workspace, in megabytes.",
   "note": "CPU/RAM ('Cores'/'Memory') are configured on the Workspace (image/template) definition and applied when a session container is created; no documented API/UI action changes CPU or RAM of an already-running session container without creating a new session.",
   "checked": "2026-09-30"
  },
  "cpu_class": {
   "value": {
    "self-host-licence": null,
    "kasm-hosted-saas": null,
    "cloud-personal": "shared"
   },
   "source": "https://kasm.com/docs/latest/guide/agent_settings.html",
   "quote": "Cores Override Instruct the system to treat the Agent as if it has this number of CPU Cores. This is useful to tactically oversubscribe the Agent. ... An Agent reports how much RAM, CPU cores, and GPU resources are available on the system. If an Agent has 6 CPU cores and 6 GB of RAM and all Images are set to 1 CPU and 1 GB of RAM, only 6 sessions can be provisioned on the agent unless resources are overridden to allow for oversubscribing.",
   "note": "Kasm Workspaces sessions are Docker containers whose CPU allocation ('Cores' per Workspace image) is a cgroup limit on a host agent that admins can explicitly configure to oversubscribe ('tactically oversubscribe the Agent'); no dedicated/reserved-core mode is documented. For self-host-licence, compute is the customer's own servers/cloud, so whether cores are dedicated or shared is entirely the customer's own infra/agent-sizing decision, not a property Kasm's licence dictates -> left null. For kasm-hosted-saas (Enterprise quote, described as 'single-tenant'), no public spec of the underlying agent host's CPU allocation model was found -> left null. For cloud-personal (Kasm's own multi-tenant SaaS, Cloud Browser/Desktop/OSINT tiers), the product page and docs publish no dedicated-core guarantee and the platform's documented oversubscription capability is the norm for container agents, so it is marked 'shared' at medium confidence (derived from the container/agent architecture, not a tier-specific quote).",
   "checked": "2026-09-30"
  },
  "usage_api": {
   "value": false,
   "source": "https://kasm.com/docs/latest/developers/developer_api.html",
   "quote": "Public Developer API covers request_kasm/destroy_kasm/exec_command_kasm (generic exec), screenshots, users, egress, casting, staging; no usage or billing endpoints.",
   "note": "granularity: none; cost: no; The Kasm Developer API provides session lifecycle management (create, destroy, exec) and monitoring (screenshots, stats) but no programmatic access to billable usage metrics (session runtime, vCPU-seconds, credits, cost). Usage/billing is available only via the web admin dashboard or account invoice.",
   "confidence": "high",
   "checked": "2026-10-01"
  }
 },
 "locations": [],
 "locations_source": null,
 "locations_quote": null,
 "locations_checked": "2026-10-01"
}