{
 "features_resolved": {
  "snapshot_any": false,
  "snapshot_mem": false,
  "fork": false,
  "pause_resume": false,
  "persistent_disk": true,
  "whole_disk": false,
  "persist_scope": true,
  "volumes": true,
  "auto_stop_idle": false,
  "long_sessions": true,
  "custom_image": true,
  "image_snapshot": false,
  "image_oci": true,
  "vm_isolation": true,
  "docker_inside": false,
  "nested_virt": false,
  "root": true,
  "systemd": null,
  "browser": false,
  "desktop": false,
  "computer_use": false,
  "code_interpreter": null,
  "browser_control": null,
  "desktop_control": null,
  "browser_and_desktop": false,
  "anti_bot": false,
  "captcha_solving": false,
  "residential_ip": false,
  "agent_harnesses": false,
  "ssh": true,
  "public_ipv4": false,
  "inbound_https": true,
  "custom_domain": true,
  "raw_tcp_inbound": null,
  "egress_allowlist": true,
  "open_internet": true,
  "static_egress_ip": false,
  "private_network": false,
  "self_host": false,
  "byoc": false,
  "open_source": true,
  "soc2": true,
  "hipaa": true,
  "sso": true,
  "gpu": true,
  "arm64": false,
  "windows": false,
  "macos": false,
  "lang_python": true,
  "lang_node": true,
  "lang_go": null,
  "lang_rust": null,
  "lang_java": null,
  "gpu_desktop": null,
  "credential_injection": null,
  "egress_http_rules": false,
  "wake_on_request": false,
  "live_resize": false,
  "fork_running": false,
  "memory_snapshot_fork": false,
  "webhooks": null,
  "scheduled_wakeups": null,
  "audit_logs": null,
  "eu_data_residency": false,
  "zero_data_retention": null,
  "scoped_api_keys": null,
  "spend_limits": null,
  "mcp_server": false,
  "usage_api": true,
  "snapshot_auto": false,
  "snapshot_on_demand": false,
  "harness_api": false,
  "own_agent_api": false,
  "fast_boot": null,
  "strong_isolation": true,
  "ingress_rules": true,
  "guest_firewall": true,
  "secret_proxy": false,
  "secret_proxy_any": false,
  "volume_attach": true,
  "volume_shared": false,
  "sidecar": null,
  "fuse": true,
  "kernel_features": true,
  "burst": null
 },
 "company": {
  "id": "tinfoil",
  "checked": "2026-09-30",
  "company": "Tinfoil Inc.",
  "ownership": {
   "value": "independent",
   "parent": null,
   "source": "https://www.ycombinator.com/companies/tinfoil",
   "quote": "Tinfoil | Encrypted AI with verifiable privacy"
  },
  "stage": {
   "value": "pre-seed",
   "source": "https://www.ycombinator.com/companies/tinfoil",
   "quote": "\"batch\":\"p2025\" ... Spring 2025",
   "confidence": "medium",
   "note": "At least pre-seed: went through Y Combinator (Spring 2025), which invests in every company it takes; no later round found.",
   "derived": true
  },
  "accelerators": [
   {
    "name": "Y Combinator",
    "batch": "Spring 2025",
    "source": "https://www.ycombinator.com/companies/tinfoil",
    "quote": "\"batch\":\"p2025\" ... Spring 2025",
    "confidence": "high",
    "via": "research"
   }
  ],
  "total_funding_usd": {
   "value": null,
   "status": "unknown"
  },
  "last_round": {
   "type": "unknown",
   "amount_usd": null,
   "date": null,
   "leads": [],
   "status": "unknown",
   "source": "",
   "quote": ""
  },
  "investors": [],
  "portfolio_listings": [],
  "revenue": {
   "value": null,
   "status": "unknown"
  },
  "employees": {
   "value": null,
   "source": ""
  },
  "note": "YC hint confirmed: the YC directory page https://www.ycombinator.com/companies/tinfoil lists company url https://tinfoil.sh (matches the card's site tinfoil.sh) and batch 'p2025' (Spring 2025), founders Tanya Verma (Founder/CEO), Jules Drean, Sacha Servan-Schreiber, Nate Sales. Company is an independent, active startup (products: Private Chat, Private Inference, Tinfoil Containers launched 2026-03-10; blog active through 2026-09-14). No funding amount/round/investor names or revenue figures were locatable via company pages, HN Algolia, or web search engines (DuckDuckGo, Bing, Google, Crunchbase, Tracxn all returned blocked/CAPTCHA/empty pages) within the ~15 minute budget; do not infer beyond YC acceptance."
 },
 "id": "tinfoil",
 "name": "Tinfoil",
 "url": "https://tinfoil.sh",
 "category": "paas",
 "isolation": "vm",
 "modes": [
  {
   "key": "native",
   "label": "Native product; see regime notes",
   "flags": [
    "alt"
   ],
   "os": [
    "linux"
   ],
   "regions": null,
   "gpu_only": false,
   "features": {},
   "pricing": "resource",
   "vcpu_h": 0.06,
   "ram_gib_h": 0.01,
   "cpu_basis": "alloc",
   "ram_basis": "alloc",
   "active_floor": 0,
   "ram_per_vcpu": [
    null,
    null
   ],
   "ram_fixed_per_vcpu": null,
   "vcpu_options": [
    2,
    4,
    8,
    16,
    32
   ],
   "min_vcpu": 2,
   "max_vcpu": 32,
   "max_ram_gib": 512,
   "sizes": null,
   "pool_tiers": null,
   "requires_always_on": false,
   "always_on_month_per_instance": null,
   "commit_note": null,
   "min_billed_seconds": 3600,
   "granularity_s": 3600,
   "start_fee": null,
   "boot_overhead_s": null,
   "multiplier": 1,
   "windows_vcpu_h": null,
   "gpu": null,
   "note": "Incomplete or non-resource economics: rates remain null, never interpreted as free."
  },
  {
   "key": "gpu-monthly",
   "label": "Confidential GPU enclave (monthly commitment)",
   "flags": [
    "alt",
    "sales"
   ],
   "gpu_only": true,
   "gpu_min_count": 1,
   "pricing": "resource",
   "vcpu_h": 0.06,
   "ram_gib_h": 0.01,
   "requires_always_on": true,
   "gpu": {
    "H200": 6.17,
    "B200": 8.22,
    "B300": 10.96
   },
   "min_billed_seconds": 3600,
   "granularity_s": 3600,
   "note": "Hourly GPU rates from the pricing page data (h200_gpu_per_hour 6.17, b200 8.22, b300 10.96) on top of CPU/RAM; 'GPUs are priced hourly but require a monthly commitment.' Pricing data lists 1/2/4/8 GPUs, the limits doc says public shapes are 'CPU-only, `gpus: 1`, or `gpus: 8`'; GPU access must be enabled for your organization ('Request GPU Access').",
   "commit_note": "GPUs are priced hourly but require a monthly commitment."
  }
 ],
 "storage": {
  "included_disk_gib": null,
  "disk_gib_month": 0.3,
  "disk_billed_when_stopped": true,
  "snapshot_gib_month": null,
  "paused_ram_billed": null
 },
 "network": {
  "egress_free_gib": null,
  "egress_gib": null,
  "ipv4_month": null,
  "ipv4_available": null,
  "internet": {
   "default": "configurable",
   "evidence": [
    {
     "quote": "No outbound access. Containers on the same `closed` network can talk to each other, but not to the internet.",
     "url": "https://docs.tinfoil.sh/containers/config-networking.md"
    },
    {
     "quote": "Control container egress with named networks and expose ports and paths through the shim.",
     "url": "https://docs.tinfoil.sh/llms.txt"
    }
   ]
  }
 },
 "plans": [
  {
   "name": "Tinfoil Containers",
   "fee": 20,
   "flags": [],
   "fee_is_credit": false,
   "included_usd": 0,
   "per_seat": 0,
   "concurrency": 10,
   "max_session_h": null,
   "max_vcpu": 32,
   "max_ram_gib": 512,
   "sizes_allowed": null,
   "note": "$20/mo base fee on top of usage ('$20 /mo + usage rates'), not a usage credit; an active container subscription is required to create or start containers; 10 container instances per org (contact to raise); GPU access must be enabled by Tinfoil."
  }
 ],
 "free": {
  "monthly_credit": null,
  "one_time_credit": null
 },
 "features": {
  "linux": true,
  "windows": false,
  "macos": false,
  "arm64": false,
  "gpu": true,
  "snapshot": "none",
  "pause_resume": false,
  "fork": false,
  "persistent_disk": true,
  "volumes": true,
  "auto_stop_idle": false,
  "max_session_h": null,
  "custom_image": true,
  "docker_inside": false,
  "nested_virt": false,
  "root": true,
  "systemd": null,
  "browser": false,
  "desktop": false,
  "computer_use": false,
  "code_interpreter": null,
  "agent_harnesses": false,
  "ssh": true,
  "public_ipv4": false,
  "inbound_https": true,
  "custom_domain": true,
  "raw_tcp_inbound": null,
  "egress_allowlist": true,
  "static_egress_ip": false,
  "private_network": false,
  "self_host": false,
  "byoc": false,
  "open_source": true,
  "soc2": true,
  "hipaa": true,
  "sso": true,
  "gpu_types": [
   "H200",
   "B200",
   "B300"
  ],
  "regions": null,
  "lang_python": true,
  "lang_node": true,
  "lang_go": null,
  "lang_rust": null,
  "lang_java": null,
  "gpu_desktop": null,
  "credential_injection": null,
  "egress_http_rules": false,
  "wake_on_request": false,
  "live_resize": false,
  "fork_running": false,
  "memory_snapshot_fork": false,
  "webhooks": null,
  "scheduled_wakeups": null,
  "audit_logs": null,
  "eu_data_residency": false,
  "zero_data_retention": null,
  "scoped_api_keys": null,
  "spend_limits": null,
  "mcp_server": false,
  "snapshot_auto": false,
  "harness_api": false,
  "egress_allowlist_level": "domain",
  "ingress_rules": true,
  "guest_firewall": true,
  "secret_proxy": false,
  "volume_attach": true,
  "volume_shared": false,
  "isolation": "qemu-kvm",
  "image_oci": true,
  "anti_bot": false,
  "captcha_solving": false,
  "egress_ip_type": "datacenter",
  "snapshot_on_demand": false,
  "own_agent_api": false,
  "max_session_unlimited": true,
  "open_internet": true,
  "usage_api": true,
  "persist_scope": "folder",
  "persist_path": "attached volumes"
 },
 "perf": {
  "cpu_runs_s": null,
  "cold_start_ms": null,
  "burst_tti_ms": null,
  "dax_s": null
 },
 "caveats": [
  "Containers pricing is published: $20/mo base + $0.06/h per core + $0.01/h per GB, billed per hour; GPUs are hourly (H200 $6.17, B200 $8.22, B300 $10.96 per GPU-h) but require a monthly commitment, access on request. Volumes $0.30/GB-month (GB-hours on provisioned size). Token inference and $20/mo Chat are separate products.",
  "Null values mean unknown, not free/unlimited. No model-token cost, tax or unverified ancillary charge included.",
  "Native browser/device/task/credit prices with unknown CPU/RAM are deliberately non-priceable. Check regime before interpreting any partial resource estimate.",
  "Deployment model: tinfoil-config.yml must live in a public GitHub repo and releases are measured/published; resources are fixed in the config ('create, start, and relaunch requests cannot override them'). No load balancing; each container instance is one enclave. Not an SDK-per-call ephemeral sandbox.",
  "Volume storage (checked 2026-10-14, https://tinfoil.sh/pricing): 'Persistent volumes are billed separately on provisioned capacity in GB-hours, prorated for elapsed time until deleted.' Rate storage_gib_per_hour 0.000410959 x 730 = $0.30/GB-month. The enclave root filesystem is a ramdisk (counted in RAM), so no disk is included. Stopped containers keep saved config. Volumes are billed on provisioned capacity until deleted, attached or not, and keep accruing after cancellation ('Retained volumes continue accruing storage charges after cancellation'). Volumes are billed per decimal GB (10^9 bytes); the card uses $0.30 per GiB-month, about 7% under a strict GiB conversion.",
  "Researchers can get discounted pricing (contact). Enterprise: dedicated infrastructure, SLAs, invoiced billing, custom pricing.",
  "Memory comes in fixed steps with an 8 GB minimum (limits doc: 8, 16, 32, 64, 128, 256, 512 GB), so a 2 vCPU / 4 GiB workload really bills 2 vCPU / 8 GB; the engine cannot express a RAM minimum or RAM steps, so small shapes are under-priced by up to $0.04/h each.",
  "Size conflict: the docs list cpus 2-32 and memory up to 512 GB; the pricing calculator data lists available_cpus up to 64 (56, 64) and available_memory_gb [8,16,32,64,128,768]. The card follows the docs (32 vCPU / 512 GiB)."
 ],
 "sources": [
  "https://www.ycombinator.com/companies/tinfoil",
  "https://tinfoil.sh/",
  "https://tinfoil.sh/pricing",
  "https://tinfoil.sh/llms.txt",
  "https://docs.tinfoil.sh/containers/limits.md",
  "https://docs.tinfoil.sh/containers/config-runtime.md",
  "https://docs.tinfoil.sh/containers/overview.md",
  "https://docs.tinfoil.sh/containers/config-networking.md"
 ],
 "top-level status": "Active. Tinfoil Containers launched 2026-03-10 (blog 'Introducing Tinfoil Containers'); latest blog post 2026-09-14.",
 "audit_2026_09_29": {
  "applied": 22,
  "source": "checked against the provider's live pricing and docs pages",
  "reviewed": 9
 },
 "fleet": {
  "default_max_instances": 10,
  "default_max_vcpu": null,
  "default_max_gpus": null,
  "raise": "sales",
  "raise_time_days": null,
  "verification": null,
  "tiers": null,
  "notes": "Up to 10 container instances per organization; 'Need higher limits? Contact us'.",
  "sources": [
   "https://docs.tinfoil.sh/containers/limits.md"
  ]
 },
 "feature_evidence": {
  "snapshot_auto": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "The enclave filesystem is a ramdisk. You can write to it, but everything is lost when the container restarts or redeploys.",
   "note": "Stop keeps only saved settings and attached encrypted volumes ('saved settings and persistent volumes remain'); no state capture.",
   "checked": "2026-09-29"
  },
  "harness_api": {
   "value": false,
   "source": "https://docs.tinfoil.sh/tutorials/coding-agents",
   "quote": null,
   "note": "The coding-agents tutorial only points Cline/OpenCode/Hermes etc. at Tinfoil's private inference API; Tinfoil Containers is a long-running confidential-container host with no agent-harness API.",
   "checked": "2026-09-29"
  },
  "egress_allowlist": {
   "value": true,
   "source": "https://docs.tinfoil.sh/containers/config-networking",
   "quote": "`allowlist` | Outbound allowed only to the hostnames in `allow`. Everything else is blocked.",
   "note": "Default: 'By default, containers cannot reach the internet or other containers.' Named networks with egress closed/allowlist/open (open still blocks RFC1918/link-local). Hostnames only, no wildcards, no IPs; re-resolved ~60 s; IPv4 only. Enforced by the enclave runtime from the measured, public tinfoil-config.yml (needs cvm-version >= 0.10.0), outside the workload container. Per-deployment config, not changeable at runtime.",
   "checked": "2026-09-29",
   "level": "domain"
  },
  "ingress_rules": {
   "value": true,
   "source": "https://docs.tinfoil.sh/containers/config-networking",
   "quote": "Only listed HTTP paths are reachable from outside the enclave. Any request to an unlisted path is rejected with a 404 error code.",
   "note": "shim.upstream-port + shim.paths (wildcards) + optional shim.origins (CORS) choose what is exposed; cvm-network.inbound-ports for admin SSH. But 'No inbound private networking. Your container is reachable over the public internet. You'll have to build in appropriate authentication yourself.' - no IP allowlist or built-in auth.",
   "checked": "2026-09-29"
  },
  "guest_firewall": {
   "value": true,
   "source": "https://docs.tinfoil.sh/containers/config-runtime",
   "quote": "Containers start with zero Linux capabilities. | Add only what you need with `cap_add`.",
   "note": "Docker containers inside an AMD SEV-SNP / Intel TDX confidential VM. cap_add can grant capabilities (NET_ADMIN not named explicitly), which would allow iptables in the container's network namespace; no-new-privileges always on. Not tested.",
   "checked": "2026-09-29",
   "derived": true
  },
  "secret_proxy": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/private-secrets",
   "quote": "enclave injects them into your container as environment variables.",
   "note": "Standard secrets live in AWS Secrets Manager and are injected at deploy time as env vars; private secrets are released by your own keyserver after attestation, also as env vars. No credential-injecting egress proxy. (tinfoil-proxy / local-proxy is a client-side attestation proxy for inference, unrelated.)",
   "checked": "2026-09-29"
  },
  "volume_attach": {
   "value": true,
   "source": "https://docs.tinfoil.sh/containers/encrypted-volumes",
   "quote": "A managed volume is a disk owned by your organization. It lives on one host, attaches to one\ncontainer instance at a time, and survives container deletion.",
   "note": "Encrypted block volumes (tinfoil volume create --size, fixed size, bound to one host), key held by the deployment owner; attach/detach while stopped. Quote has a line break in the source markdown.",
   "checked": "2026-09-29"
  },
  "volume_shared": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/encrypted-volumes",
   "quote": "a filesystem attached to one enclave at a time",
   "note": "Block volumes are single-attach. Shared data only via the open-source buckets sidecar (S3-compatible API, client-side AES-GCM encryption into your own S3 bucket, 'reachable from any number of enclaves') - object storage over an API, not a mount.",
   "checked": "2026-09-29"
  },
  "isolation": {
   "value": "qemu-kvm",
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Tinfoil Containers run any Docker image inside an AMD SEV or Intel TDX secure enclave. The container's memory is encrypted in hardware, isolated from the host, and invisible to Tinfoil.",
   "note": "Each container instance boots a full confidential VM (cvm-version) using AMD SEV-SNP / Intel TDX; closest enumerated bucket is a full-VM hypervisor (qemu-kvm-class), not a shared-kernel container boundary, since the enclave/VM is the isolation unit.",
   "checked": "2026-09-30"
  },
  "image_oci": {
   "value": true,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Tinfoil Containers run any Docker image inside an AMD SEV or Intel TDX secure enclave.",
   "note": null,
   "checked": "2026-09-30"
  },
  "docker_inside": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/config-runtime",
   "quote": "Containers start with zero Linux capabilities. | Add only what you need with `cap_add`.",
   "note": "not offered: the product runs your Docker image as the workload itself (with all capabilities dropped by default); there is no documented way to run a nested Docker daemon inside a Tinfoil Container. (A separate, undocumented GitHub example repo 'confidential-agent-sandbox' describes an Ubuntu workspace VM with its own Docker daemon, but it is not part of the documented Containers/pricing product.)",
   "checked": "2026-09-30"
  },
  "nested_virt": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/config-runtime",
   "quote": "No new privileges | `no-new-privileges:true` is always set, blocking setuid-based privilege escalation. | Cannot be disabled or configured with `security_opt`.",
   "note": "not offered: no /dev/kvm or nested-VM capability documented for Tinfoil Containers; hardened runtime defaults (dropped caps, no-new-privileges) work against it.",
   "checked": "2026-09-30"
  },
  "desktop": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Tinfoil Containers makes that same infrastructure available for running your own applications, with the same privacy, transparency, and security guarantees.",
   "note": "not offered: outside the product's scope (confidential container hosting + private AI inference/chat, no GUI desktop/VNC product).",
   "checked": "2026-09-30"
  },
  "browser": {
   "value": false,
   "source": "https://tinfoil.sh/",
   "quote": "Products: Private Chat, Private Inference, Tinfoil Containers",
   "note": "not offered: outside the product's scope. Tinfoil Chat is a private AI chat web app, not a managed/controllable browser.",
   "checked": "2026-09-30"
  },
  "computer_use": {
   "value": false,
   "source": "https://tinfoil.sh/",
   "quote": "Products: Private Chat, Private Inference, Tinfoil Containers",
   "note": "not offered: outside the product's scope; no screenshot/click driving API.",
   "checked": "2026-09-30"
  },
  "anti_bot": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Tinfoil Containers run any Docker image inside an AMD SEV or Intel TDX secure enclave.",
   "note": "not offered: outside the product's scope (confidential compute/container hosting, not a browsing/scraping product).",
   "checked": "2026-09-30"
  },
  "captcha_solving": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Tinfoil Containers run any Docker image inside an AMD SEV or Intel TDX secure enclave.",
   "note": "not offered: outside the product's scope.",
   "checked": "2026-09-30"
  },
  "egress_ip_type": {
   "value": "datacenter",
   "source": "https://docs.tinfoil.sh/containers/private-secrets",
   "quote": "Standard secrets live in AWS Secrets Manager and are injected at deploy time as env vars",
   "note": "Enclaves run on cloud (AWS-referenced) datacenter infrastructure; outbound is via named networks with hostname allowlists, no residential/mobile proxy offering documented.",
   "checked": "2026-09-30"
  },
  "snapshot": {
   "value": "none",
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "The enclave filesystem is a ramdisk. You can write to it, but everything is lost when the container restarts or redeploys.",
   "note": "No memory or filesystem snapshot/restore capability; only separately-attached encrypted block volumes persist data, and even those are not a point-in-time state snapshot of the running machine.",
   "checked": "2026-09-30"
  },
  "snapshot_on_demand": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/encrypted-volumes",
   "quote": "Everything in the enclave is lost when it stops.",
   "note": "No documented API/CLI to checkpoint or snapshot a running container's state on demand.",
   "checked": "2026-09-30"
  },
  "fork": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/cli",
   "quote": "tinfoil container list           # all containers in the org",
   "note": "not found: no clone/fork-a-machine operation documented; new containers are created from a config repo/image, not cloned from a running instance.",
   "checked": "2026-09-30"
  },
  "fork_running": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/cli",
   "quote": "tinfoil container get my-app     # full detail for one container",
   "note": "not offered: no running-machine clone capability documented.",
   "checked": "2026-09-30"
  },
  "memory_snapshot_fork": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Everything in the enclave is lost when it stops.",
   "note": "not offered: no memory-preserving fork/clone documented; consistent with no snapshot capability at all.",
   "checked": "2026-09-30"
  },
  "pause_resume": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Everything in the enclave is lost when it stops.",
   "note": "not found: containers are started/stopped, not paused with state retained; no reduced-billing pause state documented.",
   "checked": "2026-09-30"
  },
  "wake_on_request": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/limits",
   "quote": "Each organization can have up to 10 container instances.",
   "note": "not offered: no autoscale-to-zero / wake-on-request behavior documented; containers run continuously once started and are billed hourly.",
   "checked": "2026-09-30"
  },
  "auto_stop_idle": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/limits",
   "quote": "Each organization can have up to 10 container instances.",
   "note": "not found: no idle-timeout auto-stop documented; billing plan bills per-hour usage with no mention of idle shutdown.",
   "checked": "2026-09-30"
  },
  "live_resize": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/limits",
   "quote": "create, start, and relaunch requests cannot override them... you can always resize by redeploying with an updated `tinfoil-config.yml`.",
   "note": "Resizing requires a redeploy/relaunch with a new measured config, not a live in-place resize of a running machine.",
   "checked": "2026-09-30"
  },
  "agent_harnesses": {
   "value": false,
   "source": "https://docs.tinfoil.sh/tutorials/coding-agents",
   "quote": "Most coding agents (Cline, Factory Droid, OpenCode, Hermes, Continue, Aider…) talk to a configurable OpenAI-compatible base URL. That's all Tinfoil needs to slot in.",
   "note": "not offered: this tutorial only points external, locally-run coding agents at Tinfoil's inference API; no coding-agent harness is preinstalled/offered as a template inside a Tinfoil Container.",
   "checked": "2026-09-30"
  },
  "own_agent_api": {
   "value": false,
   "source": "https://tinfoil.sh/",
   "quote": "Products: Private Chat, Private Inference, Tinfoil Containers",
   "note": "not offered: outside the product's scope; Tinfoil ships an OpenAI-compatible inference API and a chat app, not a first-party browser/computer-use/research task agent.",
   "checked": "2026-09-30"
  },
  "mcp_server": {
   "value": false,
   "source": "https://docs.tinfoil.sh/guides/mcp-websearch",
   "quote": "The confidential-websearch MCP server runs inside a Tinfoil secure enclave and exposes two tools: `search` ... and `fetch`",
   "note": "Tinfoil ships an MCP server for its own web-search/inference tool-calling feature, not an MCP server to control Tinfoil Containers/sandboxes themselves (management is via dashboard, CLI, and Admin API).",
   "checked": "2026-09-30"
  },
  "lang_python": {
   "value": true,
   "source": "https://docs.tinfoil.sh/sdk/python-sdk",
   "quote": "Python SDK for Tinfoil's secure AI inference API",
   "note": "First-party Python SDK exists for calling Tinfoil's attested API; Tinfoil Containers itself is bring-your-own-Docker-image, so no fixed Python runtime ships out of the box inside a Container.",
   "checked": "2026-09-30"
  },
  "lang_node": {
   "value": true,
   "source": "https://docs.tinfoil.sh/sdk/javascript-sdk",
   "quote": "JavaScript SDK for Tinfoil's secure AI inference API",
   "note": "First-party JS/Node SDK exists for calling Tinfoil's attested API; Tinfoil Containers itself is bring-your-own-Docker-image, so no fixed Node runtime ships out of the box inside a Container.",
   "checked": "2026-09-30"
  },
  "public_ipv4": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "No inbound private networking. Your container is reachable over the public internet. You'll have to build in appropriate authentication yourself.",
   "note": "Containers are reached via hostname routing (default `*.containers.tinfoil.dev` subdomain or a custom domain), not documented as a dedicated public IPv4 per machine.",
   "checked": "2026-09-30"
  },
  "egress_http_rules": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/config-networking",
   "quote": "`allowlist` | Outbound allowed only to the hostnames in `allow`. Everything else is blocked.",
   "note": "Egress control is hostname-level only (allow specific hostnames or open/closed); no HTTP method/path-level egress rules.",
   "checked": "2026-09-30"
  },
  "windows": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Tinfoil Containers run any Docker image inside an AMD SEV or Intel TDX secure enclave.",
   "note": "not offered: outside the product's scope; AMD SEV-SNP/Intel TDX confidential-VM Docker hosting is Linux-only, no Windows machine option.",
   "checked": "2026-09-30"
  },
  "macos": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Tinfoil Containers run any Docker image inside an AMD SEV or Intel TDX secure enclave.",
   "note": "not offered: outside the product's scope; no macOS machine option.",
   "checked": "2026-09-30"
  },
  "arm64": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/limits",
   "quote": "Each container specifies its CPU, memory, and GPU requirements in `tinfoil-config.yml`.",
   "note": "not offered: the confidential-computing platform is built on AMD SEV-SNP / Intel TDX (x86_64); resource options list only CPU/memory/GPU counts, no ARM architecture choice.",
   "checked": "2026-09-30"
  },
  "self_host": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Tinfoil Containers run any Docker image inside an AMD SEV or Intel TDX secure enclave.",
   "note": "not offered: enclaves run on Tinfoil-operated infrastructure; no documented option to run the Tinfoil Containers platform on your own infrastructure.",
   "checked": "2026-09-30"
  },
  "byoc": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/overview",
   "quote": "Tinfoil Containers run any Docker image inside an AMD SEV or Intel TDX secure enclave.",
   "note": "not found: no documented option to deploy the managed service into a customer-owned cloud account.",
   "checked": "2026-09-30"
  },
  "max_session_h": {
   "value": "none",
   "source": "https://docs.tinfoil.sh/containers/updates",
   "quote": "Tinfoil uses a blue-green update strategy for running CPU-only and single-GPU container instances... the new version boots alongside the current one, and traffic switches atomically once it reaches Ready.",
   "note": "Containers are long-running services billed hourly (min_billed_seconds/granularity_s = 3600) with no documented maximum runtime/forced stop; they run until you stop/delete or update them.",
   "checked": "2026-09-30"
  },
  "persistent_disk": {
   "value": true,
   "corrected_from": false,
   "source": "https://docs.tinfoil.sh/containers/encrypted-volumes",
   "quote": "A managed volume is a disk owned by your organization. It lives on one host, attaches to one container instance at a time, and survives container deletion.",
   "note": "Card said false, but this contradicts its own volume_attach=true/volumes=true. Tinfoil's own root enclave filesystem is a ramdisk that is wiped on restart ('Everything in the enclave is lost when it stops' / 'Data written to the local filesystem is lost when the enclave restarts'), but customers can attach an encrypted managed volume ('Persistent disk' in Tinfoil's own diagram) that survives container stop, restart, and even deletion, and is reattached on later starts. Default behaviour: root disk = ephemeral (delete on stop/restart); persistent volumes are opt-in via `tinfoil volume create` + `--volume` attach in tinfoil-config.yml.",
   "checked": "2026-09-30"
  },
  "private_network": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/troubleshooting",
   "quote": "Inside the enclave, your app runs in an isolated network. External services (databases, APIs) must be reachable over the public internet. There's no VPC peering or private network access.",
   "note": "Confirmed directly: Tinfoil explicitly documents there is no VPC peering or private network access to external services. The 'networks' feature (docs.tinfoil.sh/containers/config-networking) only lets containers within the SAME enclave/config talk to each other over an internal bridge (egress: closed) or over the fixed shim-net channel; it does not provide cross-instance/VPC private networking, and inbound is public-only ('No inbound private networking. Your container is reachable over the public internet.').",
   "checked": "2026-09-30"
  },
  "static_egress_ip": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/config-networking",
   "quote": "`allowlist` | Outbound allowed only to the hostnames in `allow`. Everything else is blocked.",
   "note": "Egress control in Tinfoil Containers is entirely hostname-based (named networks with closed/allowlist/open policies, hostnames re-resolved ~60s, IPv4 only); no documented feature gives a container a fixed/static outbound IP address. Not found anywhere in the containers docs, config reference, limits, or production checklist.",
   "checked": "2026-09-30"
  },
  "hipaa": {
   "value": true,
   "source": "https://trust.tinfoil.sh",
   "quote": "Compliance SOC 2 HIPAA GDPR",
   "note": "Tinfoil's public compliance/trust portal (trust.tinfoil.sh) lists HIPAA alongside SOC 2 and GDPR as a compliance framework the company attests to. This indicates HIPAA-eligibility; the portal does not itself state whether a BAA is available on request, but listing HIPAA as a compliance framework on the trust portal is the provider's own claim of HIPAA compliance/readiness.",
   "checked": "2026-09-30"
  },
  "eu_data_residency": {
   "value": false,
   "source": "https://docs.tinfoil.sh/containers/configuration",
   "quote": "Every Tinfoil Container requires a `tinfoil-config.yml` file ... This file defines the enclave runtime, resource allocation, container configuration, and request routing.",
   "note": "The full tinfoil-config.yml schema (cvm-version, cpus, memory, gpus, models, networks, cvm-network, attested-keys, volumes, containers, shim) has no region/location/zone field, and no containers doc page mentions choosing a deployment region. Tinfoil lists GDPR as a compliance framework on its trust portal and has an EU-region cloud subprocessor (Latitude.sh, 'European Union, Brazil'), but there is no customer-facing feature to select or pin an EU region for containers, so 'you can keep machines/data in EU regions' is not offered as a controllable feature.",
   "checked": "2026-09-30"
  },
  "usage_api": {
   "value": true,
   "source": "https://docs.tinfoil.sh/admin/admin-api.md",
   "quote": "The Admin API lets you manage regular API keys and inspect billing data for a personal account or organization. Common use cases: Building custom dashboards: Display usage metrics, cost breakdowns by model, and historical trends using the billing and time-series endpoints. Monitoring usage: Query ag",
   "note": "granularity: per-key; cost: yes; The Admin API provides billing/usage endpoints: GET /api/billing/usage (aggregated), POST /api/billing/usage/key (per-key), GET /api/billing/time-series, and GET /api/billing/transactions. The billing/usage endpoint response includes cost field in nanodollars (e.g., 'cost': 15.00). However, this is for the Tinfoil inference API usage (token-based billing). For Tinfoil Containers (the sandbox/VM product in this card), there is GET /api/containers/:id/metrics which provides resource utilization monitoring (CPU/GPU/memory percentages) but not billable usage per-container. Container billing is account-level (hourly, based on allocation) with no per-container billable-usage API endpoint documented.",
   "confidence": "high",
   "checked": "2026-10-01"
  },
  "persist_scope": {
   "value": "folder",
   "source": "https://docs.tinfoil.sh/containers/encrypted-volumes",
   "quote": "A managed volume is a disk owned by your organization. It lives on one host, attaches to one container instance at a time, and survives container deletion.",
   "note": "Only attached volumes survives a stop; the rest of the filesystem (packages installed elsewhere) resets.",
   "checked": "2026-10-01"
  },
  "gpu_types": {
   "value": [
    "H200",
    "B200",
    "B300"
   ],
   "source": "https://tinfoil.sh/pricing",
   "quote": "\"b200_gpu_per_hour\":8.22,\"b300_gpu_per_hour\":10.96,...,\"h200_gpu_per_hour\":6.17",
   "note": "From the pricing page's containerPricing.rates (Next.js payload; the Containers tab is client-rendered). FAQ: 'GPUs are priced hourly but require a monthly commitment.' The earlier $2,000/$5,000 per-GPU monthly figures are no longer on the page.",
   "checked": "2026-10-14"
  },
  "root": {
   "value": true,
   "source": "https://docs.tinfoil.sh/containers/config-runtime.md",
   "quote": "A container with `cvm_admin: true` is exempt from these defaults: it runs privileged, as root, with a writable root filesystem.",
   "note": "Only the admin container. Regular workload containers start with zero capabilities (cap_add limited to IPC_LOCK, NET_BIND_SERVICE, SYS_NICE), `privileged` and `devices` are rejected, and the root filesystem is read-only by default. cvm_admin grants administration of the whole enclave, including other workloads and their secrets.",
   "checked": "2026-10-14"
  },
  "ssh": {
   "value": true,
   "source": "https://docs.tinfoil.sh/containers/config-networking.md",
   "quote": "An administrator workspace can expose SSH directly.",
   "note": "Off by default: 'No SSH access by default. Since your container runs in a secure enclave, you can't shell into it by default.' (https://docs.tinfoil.sh/containers/overview.md). Two routes: debug mode (a separate instance that does not pass attestation) or direct admin SSH with `cvm_admin: true`, inbound port 22 and a 22:22 mapping (attested SSH, beta).",
   "checked": "2026-10-14"
  }
 },
 "locations": [],
 "locations_source": "https://docs.tinfoil.sh/containers/configuration",
 "locations_quote": "Every Tinfoil Container requires a tinfoil-config.yml file in the root of your GitHub repository. This file defines the enclave runtime, resource allocation, container configuration, and request routing. [No region field documented in schema]",
 "locations_checked": "2026-10-01"
}