5 best HIPAA-compliant AI sandboxes with a BAA in 2026

Your agent pipeline works. It parses clinical documents, executes generated code, and returns structured results. Then compliance review asks whether your vendor will sign a Business Associate Agreement (BAA).

The Health Insurance Portability and Accountability Act (HIPAA) defines business associates broadly. Any cloud service that creates, receives, maintains, or transmits electronic protected health information (ePHI) qualifies. Read access isn’t required. A sandbox needs a BAA before protected health information (PHI) touches it. The feature is already live in staging. Legal won’t let PHI near it until that agreement exists.

This roundup covers confirmed and conditional BAA candidates in 2026. It also identifies gaps in sandbox-specific scope. “HIPAA-compliant” here means supporting regulated workloads under defined configurations. It does not mean HIPAA certification or blanket product compliance.

TL;DR:

• BAA scope is the gate: A platform-level BAA that omits the sandbox product leaves your riskiest execution surface uncovered. Verify sandbox, snapshots, volumes, and logs in writing.
• Blaxel BAA without Enterprise: Blaxel offers a BAA add-on on usage-based tiers with Firecracker microVM isolation, perpetual standby, and SOC 2 Type II.
• Fly.io has the lowest flat fee: A $99/month compliance package covers Machines and Managed Postgres with no tier requirement.
• Conditional coverage elsewhere: Modal requires Enterprise for a BAA and excludes Memory Snapshots. Vercel's BAA doesn't name Sandbox in its covered-services list.
• Several vendors don't qualify: E2B, Daytona, Together AI, and Cloudflare don't confirm BAA availability that covers their sandbox products.

How we chose these platforms

BAA availability was the first filter. Six more criteria shaped the ranking:

• BAA scope for the sandbox product: A platform-level BAA doesn’t automatically cover the sandbox. Cloudflare signs BAAs with Enterprise customers. Its in-scope list names CDN, web application firewall, and Bot Management.
• Isolation model: Firecracker microVMs give AI-generated code a kernel boundary enforced through hardware virtualization. Shared-kernel containers cannot provide that boundary, while gVisor provides stronger isolation than containers without hardware enforcement.
• State lifecycle and disposal: HIPAA requires organizations to clear or destroy media holding ePHI. Standby snapshots and volumes extend where PHI lives.
• Standby and resume behavior: Disk-only snapshots preserve disk state but not memory. Agents must restart processes after resume and reload runtime context that wasn’t written to disk.
• Audit posture: SOC 2 Type II attestation and exportable logging evidence both matter. HIPAA requires six-year documentation retention.
• SDK coverage and cost: The review considers first-class language SDKs and compliance-related charges.

Together, these criteria separate contract availability from usable coverage for the execution layer.

E2B doesn’t confirm BAA availability. Daytona bars sensitive data, and Together AI bars medical data. Cloudflare’s public HIPAA materials don’t list Containers or the Sandbox SDK. If procurement cannot verify one of these points, the review stops there.

Ordering follows how fully each platform meets those criteria. Documented BAA availability comes first, followed by sandbox-specific scope, isolation, lifecycle, and cost. Conditional candidates remain included because their scope gaps affect real procurement decisions.

Where vendors publish machine-level rates, figures use roughly 1 vCPU and 2 GB RAM. Modal and Runloop publish plan fees plus usage. Blaxel uses usage-based pricing with optional add-ons. Missing dimensions appear as not publicly disclosed in the comparison table.

1. Blaxel

The Blaxel platform is the infrastructure foundation for autonomous agents. It provides the execution layer for agent code in production. Blaxel holds SOC 2 Type II and ISO 27001 certifications. A signed BAA is available as an add-on on usage-based tiers. Buyers should obtain written confirmation that Sandboxes, standby snapshots, Volumes, Agent Drive, and logs fall within the signed scope. Firecracker microVM isolation pairs with perpetual standby for long PHI sessions.

Key features

Blaxel’s main differentiators cover isolation, lifecycle, and persistent storage:

• Firecracker microVM isolation: Each sandbox runs its own kernel behind a hardware virtualization boundary.
• Perpetual standby with sub-25ms resume: Sandboxes preserve filesystem and memory state indefinitely. Idle standby carries no compute charge.
• Network-based auto-shutdown: Sandboxes enter standby after roughly 15 seconds of network inactivity.
• Volumes and Agent Drive: Volumes hold PHI that must outlive a sandbox. Agent Drive, in private preview, carries context across sessions.
• Logs and SDK access: Teams can stream sandbox logs through the platform. First-class SDKs cover Python, TypeScript, and Go.

These controls reduce reload work while keeping persistent PHI locations visible during review.

Pros

The strongest advantages apply to production coding agents that handle regulated data:

• Accessible BAA add-on: A BAA is available as an add-on on any usage-based tier. It does not require an Enterprise contract, although buyers must confirm the covered services in writing.
• Memory-preserving resume: Long PHI sessions remain intact between agent turns.
• OpenAI Agents SDK support: Blaxel is a first-class sandbox provider in the OpenAI Agents SDK. Blaxel Sandboxes handle execution beneath OpenAI’s Codex harness.

These benefits favor teams that need persistent execution without a sales-led Enterprise tier.

Cons

The main limitations concern language ergonomics and deployment control:

• SDK language coverage: First-class SDKs cover Python, TypeScript, and Go. Ruby, Java, and Rust teams use the REST API.
• No air-gapped install: Blaxel doesn’t offer a fully air-gapped installation. Bring your own metal (BYOM) and virtual private cloud (VPC) interconnect retain a Blaxel-managed control plane.
• Volume persistence after deletion: Attached Volumes persist after sandbox deletion. Teams must include them in the PHI data-path map.

These limits matter most for non-supported language stacks and teams comparing Blaxel with customer-controlled deployment models.

Pricing

Blaxel’s pricing combines usage charges with optional support and compliance add-ons:

• Free: The Free tier includes up to $200 in free credits plus usage costs.
• Pre-configured sandbox tiers and usage-based pricing: See Blaxel’s pricing page for the most up-to-date pricing information.
• Available add-ons: Available add-ons include email support, live Slack support, and HIPAA compliance.

The linked pricing page provides the current usage rates and add-on terms.

Who is Blaxel best for?

• Teams putting PHI-handling coding agents into production without an Enterprise procurement cycle.
• Teams needing customer-controlled runtime hardware can evaluate BYOM.
• A fully self-hosted control plane requires another deployment model.

2. Fly.io

The Fly.io platform runs Machines as Firecracker microVMs launched from Docker images. Its pre-signed BAA activates on signature. The agreement ships inside a paid Compliance Package with no tier requirement. Fly.io confirms coverage for Machines and Managed Postgres.

Fly.io documents suspend and resume behavior for its Machines. Volumes persist across suspend and cold start. Fly.io calls those volumes persistent, not durable, long-term storage.

Public evidence includes HIPAAtherapy, a clinical SaaS that runs on Fly.io. HIPAAtherapy also signs BAAs with its customers. Fly.io reports SOC 2 Type 2 attestation. Capacity reports document failures in ORD and IAD, which are Fly.io region codes. Fly.io’s pricing documentation also describes its billing surfaces.

Key features

Fly.io combines hardware isolation with suspendable regional Machines:

• Firecracker microVMs: Each Machine runs its own kernel behind a hardware boundary.
• Suspend and resume: A Machine resumes in a few hundred milliseconds when its snapshot survives. Otherwise, it cold-boots.
• Fly Volumes: Volumes persist across suspend and cold start. Fly.io keeps volume snapshots for five days by default.

The model works best when applications checkpoint PHI to storage rather than depend on memory snapshots.

Pros

Fly.io’s advantages center on contract accessibility and explicit compute coverage:

• Published flat BAA fee: Fly.io publishes a flat compliance fee with no tier restriction.
• Explicit compute coverage: Fly.io confirms BAA scope for the compute product.
• Healthcare production evidence: HIPAAtherapy runs on Fly.io and signs BAAs with its own customers.
• Audit posture: Fly.io reports SOC 2 Type 2 attestation.

This combination gives procurement a comparatively direct path to covered general-purpose compute.

Cons

The documented limitations concern regional capacity and expanding billing surfaces:

• Regional capacity failures: Fly.io region codes ORD and IAD have documented capacity failures, including “could not reserve resource” errors.
• Stopped-machine storage charges: Fly.io charges $0.15 per GB monthly for stopped-machine root filesystems.
• Volume snapshot charges: Volume snapshot charges began January 1, 2026.

Teams should test capacity in their target regions and model storage charges before committing.

Pricing

Fly.io publishes both machine-level rates and a separate compliance fee:

• Baseline compute: The shared-cpu-1x pricing with 2 GB RAM is about $0.0171 hourly. That equals about $12.34 monthly.
• Compliance Package: The Compliance Package costs $99 monthly.

This pricing is directly comparable for teams that can use the shared CPU configuration.

Who is Fly.io best for?

• Teams that want the lowest published flat BAA fee in this roundup.
• Workloads that checkpoint PHI on Volumes.
• Long sessions needing memory-preserving resume fit Blaxel better.

3. Modal

The Modal platform is a Python-native serverless platform with an adjacent Sandboxes product. Sandboxes use gVisor by default. That user-space kernel intercepts system calls and improves isolation over plain containers. It does not create a hardware boundary. A BAA requires Enterprise.

Modal allows Sandboxes to run for a configurable period. Both filesystem and memory snapshots have a limited retention window. Inputs route through Virginia by default, and Modal fixes the routing region after deployment.

Modal offers per-second billing without minimum increments. It reports SOC 2 Type II completion with no deviations. Modal confirms that Volumes v2 fall within its documented HIPAA scope. Its BAA excludes Volumes v1, most Images, Memory Snapshots, and user code.

Key features

Modal’s sandbox lifecycle has explicit duration and retention boundaries:

• Sandbox lifetime: Sandboxes run up to a configurable 24 hours. Long PHI sessions must checkpoint before that ceiling.
• Snapshot retention: Filesystem and memory snapshots are deleted after seven days.
• Region routing: Inputs route through Virginia by default. Modal fixes the routing region after deployment.

These boundaries require deliberate checkpointing and region selection before PHI enters the service.

Pros

Modal’s strengths apply most directly to existing Python-native serverless teams:

• Enterprise agreement: One agreement covers Modal’s documented in-scope services, subject to its exclusions.
• Per-second billing: Modal bills Sandbox compute per second without minimum increments.
• Audit and storage scope: Modal reports SOC 2 Type II completion with no deviations. Volumes v2 fall within HIPAA scope.

Existing Modal users can keep sandbox workloads beside their broader serverless environment.

Cons

Modal’s documented cost multiplier is the primary matrix-approved limitation relevant here:

• 3x Sandbox cost multiplier: Sandboxes and Notebooks cost three times standard Function rates.

That multiplier should be included when teams compare equivalent CPU and memory usage.

Pricing

Modal publishes plan fees, but the available evidence doesn’t provide a complete baseline calculation here:

• Starter: The Starter plan costs $0 plus compute usage.
• Team: The Team plan costs $250 monthly plus compute usage.
• Enterprise: The Enterprise plan uses custom pricing and is required for a BAA.

Teams need an Enterprise quote to calculate the complete cost of HIPAA-regulated Sandbox use.

Who is Modal best for?

• Teams already running Python-native serverless workloads on Modal.
• Fly.io publishes flat-fee BAA access; Modal enters BAAs only with Enterprise customers.

4. Runloop

The Runloop platform provides Devboxes with hardened isolation for AI-generated code. Runloop uses a micro-VM with a container, placing generated code behind two boundaries. Its security page lists HIPAA-Eligible status, with BAA availability through sales. Its VPC deployment page confirms HIPAA-eligible configurations.

Runloop documents fast creation from large images. Its security page also lists SOC 2 Type II. Runloop describes its broader platform as supporting HIPAA-regulated configurations.

Object Storage availability is documented separately. The available material does not confirm Object Storage’s specific BAA scope. Suspend and resume preserve disk state only. Daemons require manual restarts after resuming. Devboxes and snapshots persist until shutdown by default.

Key features

Runloop emphasizes layered isolation and fast creation from large images:

• Dual-layer isolation: A micro-VM runs a container on top. This places generated code behind two boundaries.
• Cold start: A 10 GB image boots in under two seconds. Each PHI request can therefore receive a fresh Devbox.

These capabilities favor workflows that recreate environments instead of preserving live memory.

Pros

Runloop’s clearest advantage is deployment inside a customer-controlled network boundary:

• VPC deployment: This option addresses buyers that require a VPC deployment for PHI workloads.
• Audit posture: Runloop lists SOC 2 Type II on its security page.
• BAA availability: Runloop offers BAA availability through sales for HIPAA-eligible configurations.

Buyers should confirm that Devboxes, storage, snapshots, and logs all appear in the signed scope.

Cons

The available sources identify lifecycle considerations that require validation during procurement:

• Disk-only resume: Suspend and resume preserve only disk state, so teams must restart daemons manually.
• Persistent suspended state: Suspended Devboxes and snapshots persist until teams shut them down.

These points affect process restoration and data disposal.

Pricing

Runloop publishes plan fees but not every baseline usage dimension:

• Basic: The Basic plan is free and includes 100 GB of storage.
• Pro: The Pro plan costs $250 monthly plus usage and includes 1 TB of storage.
• Enterprise: Enterprise pricing requires sales contact.

A complete HIPAA cost estimate requires both a usage quote and confirmed BAA terms.

Who is Runloop best for?

• Healthcare coding-agent teams that need VPC deployment.
• Sales-led BAA procurement adds a contract cycle.
• Blaxel also offers BYOM and VPC interconnect, but its control plane remains managed.

5. Vercel Sandbox

The Vercel platform runs untrusted code in Firecracker microVMs attached to Vercel. Vercel provides BAAs to eligible Enterprise and Pro customers. Enterprise customers can request a signed BAA. Pro customers can obtain a click-through BAA through a HIPAA add-on. Vercel’s covered-services list names CDN, Functions, and the build pipeline. It does not name Sandbox.

Vercel snapshots the filesystem on stop and restores it on resume. Sandbox reached general availability on January 30, 2026. Persistence reached GA on May 26, 2026.

Vercel documents a fixed session ceiling for Pro and Enterprise sandboxes. Each sandbox also receives ephemeral NVMe storage. Vercel introduced a self-serve BAA add-on for Pro teams on September 9, 2025. The platform supports large concurrent sandbox fleets.

Vercel bills provisioned memory for the full session with one-minute minimums. It also bills outbound traffic. Vercel’s official claim is sub-second startup.

Key features

Vercel combines filesystem restoration with fixed session and storage boundaries:

• Filesystem persistence: Vercel snapshots the filesystem on stop and restores it on resume. PHI written to disk survives that cycle.
• 24-hour session ceiling: Pro and Enterprise sandboxes run up to 24 hours. Longer PHI workflows must checkpoint before recreation.
• Ephemeral storage: Each sandbox receives 32 GB of ephemeral NVMe storage. Vercel clears it when the sandbox disappears.

These controls require teams to map both restored filesystems and terminal storage into PHI disposal procedures.

Pros

Vercel’s advantages apply primarily to teams already using its Pro platform:

• Self-serve BAA access: Pro teams can purchase a BAA add-on through billing settings.
• Hardware isolation: Each sandbox is a Firecracker microVM with a dedicated kernel.
• Large fleet support: Teams can run up to 10,000 concurrent sandboxes for large agent fleets.

The existing billing and deployment relationship can reduce procurement work for current Vercel customers.

Cons

The central limitation is contract scope rather than the availability of a platform-level BAA:

• Sandbox not named in BAA scope: Vercel Sandbox is not expressly named among the published BAA-covered services.
• Full-session memory billing: Vercel bills provisioned memory for the full session. A one-minute minimum applies, and outbound traffic is billable.

Teams should obtain written Sandbox coverage before sending PHI into the product.

Pricing

Vercel publishes enough rates for an approximate baseline calculation:

• Compute: Active CPU costs $0.128 hourly, excluding I/O wait. Provisioned memory costs $0.0212 per GB-hour.
• Creation and transfer: Sandbox creation costs $0.60 per million. Data transfer costs $0.15 per GB.
• Baseline: One vCPU and 2 GB RAM cost about $0.1704 hourly during active CPU use.

The BAA add-on price is not publicly disclosed in the available material.

Who is Vercel Sandbox best for?

• Existing Pro teams that obtain written confirmation of Sandbox coverage.
• Without that confirmation, keep PHI on a product with explicit compute scope.

Comparison table

The table uses a common 1 vCPU and 2 GB RAM baseline where public rates permit calculation.

Pricing as of August 2026.

How to choose

If PHI enters the sandbox, written BAA scope outranks every other criterion. The agreement should name the compute product, storage paths, snapshots, and logging services. A platform-level BAA that omits the sandbox leaves your riskiest surface uncovered.

Next, match the isolation model to your threat profile. Firecracker microVMs give AI-generated code a hardware-enforced kernel boundary. gVisor and shared-kernel containers offer weaker separation for untrusted execution.

Then weigh lifecycle behavior. For long-lived sessions, compare memory-preserving resume against disk-only restoration. Disk-only models force process restarts and PHI reloads after every resume. Memory-preserving standby keeps agent context intact between turns.

Cost and disposal decide the rest. Model compute rates, storage charges, and any compliance add-on against your expected usage. Check what each vendor retains after a sandbox stops.

Start by mapping every location where PHI enters, persists, or leaves the execution layer. That map tells you which BAA scope, isolation model, and retention policy your workload actually needs.

Get a HIPAA-compliant AI sandbox with a BAA that covers the sandbox

PHI lives in the execution layer during an agent run. That layer includes memory, filesystems, snapshots, volumes, and logs. Choose a vendor whose signed BAA names the relevant services and configurations.

Agent infrastructure platforms like Blaxel combine Firecracker microVMs with persistent execution state. The hardware-enforced kernel boundary limits the blast radius of untrusted code. It does not replace access controls, egress restrictions, or application security.

For cross-session PHI, use storage with an explicit retention and deletion policy. Blaxel provides Volumes and Agent Drive in private preview for those workflows. Standby state and durable storage require different disposal procedures.

Explore the Blaxel product stack when those controls match your requirements. You can also book a demo to review PHI data paths with the engineering team.

FAQs

Does a signed BAA make my AI agent HIPAA compliant?

No. A BAA defines a vendor’s contractual obligations for named infrastructure services. It does not certify your application or transfer every compliance duty to the vendor. Access management and logging, egress policies, and multi-factor authentication stay within your control. Before signing, map each service in an agent run—sandbox, storage, logs, model gateways, and proxies—against the agreement’s covered-services schedule. A signed BAA for an unrelated platform service does not cover the sandbox automatically.

Is data in an ephemeral sandbox exempt from HIPAA?

No. HIPAA obligations depend on handling PHI, not how briefly infrastructure stores it. The conduit exception covers transmission-only services; a sandbox that stores files, memory snapshots, or logs falls outside that narrow role. A provider without decryption keys can still qualify as a business associate. Verify what “ephemeral” means for each vendor—a stopped instance can leave snapshots, filesystems, volumes, or logs behind. Test deletion behavior and document retention periods before introducing PHI.

What should I verify before signing a sandbox BAA?

Check the covered-services list first—it should name the sandbox product itself. Cloudflare and Vercel don’t list their sandbox products in public materials, and Blaxel buyers should confirm Sandboxes fall within scope in writing. Next, verify snapshot, volume, image, and log coverage; Modal’s exclusions show why platform-level language is insufficient. Finally, confirm subcontractor flow-down and the Security Rule documentation retention period. Ask the vendor to mark every covered service and excluded configuration in writing.