6 Best SOC 2 compliant sandbox providers

Your agent generates code, executes it in an isolated environment, and returns results. It works in development. Then an enterprise prospect sends over a security questionnaire. The first question asks for your sandbox provider's System and Organization Controls 2 (SOC 2) Type II report. Suddenly, API ergonomics aren't enough. The platform must prove its controls work in production.

SOC 2 Type II matters because it verifies operating effectiveness over a review period. It doesn't only review control design once. For AI agents that execute untrusted code, the risk gets specific. Large language model (LLM)-generated code can read files, environment variables, and tool outputs. Those inputs often contain confidential data. Agents can reproduce that data into transcripts, commit messages, and later tool calls. The sandbox layer is where tenant isolation, egress control, and audit logging face review. Weak controls also fall apart during procurement.

This guide compares sandbox providers on criteria that decide enterprise deals. The main factors are isolation model, standby and resume latency, statefulness, pricing model, and compliance posture. Each platform gets a direct assessment of where it fits. Each section also explains where it doesn't.

How we chose these platforms

Compliance certifications are a starting filter, not the whole picture. A SOC 2 Type II badge tells you controls were audited. You still need to verify the audit scope covers production systems. Corporate IT scope alone isn't enough. Beyond the certificate, the platform must protect tenant data during code execution.

We evaluated each provider against seven criteria. Each criterion matters for AI agent code under compliance requirements:

• Isolation model: This boundary prevents one tenant's code from reaching another's data. MicroVMs give each sandbox its own guest kernel. Containers share the host kernel.
• Standby and resume latency: This measures how fast a paused sandbox comes back. For interactive agents, tool-call latency is user-visible. Sub-100ms resume keeps the experience responsive.
• Statefulness across sessions: This shows whether the sandbox retains filesystem and memory state between invocations. Long-running agents avoid re-cloning repos when state persists. They also avoid rebuilding caches.
• Networking control: Default-deny egress with explicit allowlisting is the primary defense against data exfiltration. A prompt-injected agent can't send data to arbitrary servers. That protection holds when egress routes through a controlled proxy.
• Language and SDK support: First-class SDKs reduce integration work. Standard Open Container Initiative (OCI) images reduce packaging lock-in.
• Pricing model: Idle billing changes total cost. Active-CPU-only billing matters for agents with high idle-to-active ratios.
• Compliance posture: Official sources confirm SOC 2 Type II, ISO 27001, and Health Insurance Portability and Accountability Act (HIPAA) claims. Verify each claim through the provider trust or compliance page.

These criteria separate platforms that can pass procurement from platforms that only work in prototypes.

1. Blaxel

Blaxel platform is the infrastructure foundation for autonomous agents. It is the execution layer where AI agents run code in production. Each sandbox runs in a dedicated Firecracker microVM with its own kernel. That model gives hardware-enforced tenant isolation for untrusted, LLM-generated code.

What separates Blaxel from every other platform here is perpetual standby. Sandboxes automatically snapshot complete filesystem and running process state. They then resume in under 25ms. You can see how it handles agent code execution end to end.

Blaxel lists SOC 2 Type II and ISO 27001 certifications for enterprise procurement. HIPAA compliance is available through a Business Associate Agreement (BAA). When a sandbox is deleted before entering standby, Blaxel guarantees Zero Data Retention (ZDR). The ZDR architecture relies on a RAM-based filesystem. Deleting the microVM instantly erases all files with no residual traces on disk.

Key features

Blaxel's core features focus on persistent, secure agent code execution:

• Firecracker microVM isolation: Each sandbox runs its own guest kernel. Exploits inside one sandbox stay isolated from the host and neighboring tenants.
• Perpetual standby with sub-25ms resume: Blaxel sandboxes stay dormant indefinitely with no compute charge. They resume with complete filesystem and memory state restored.
• Network-based auto-shutdown: Sandboxes transition to standby roughly 15 seconds after the last active connection drops. This removes idle compute charges without manual management.
• Managed agent networking: Custom domains and proxy-based egress with allowlisting ship out of the box. Dedicated egress gateways for static outbound IPs are currently in private preview.
• First-class OpenAI Agents SDK support: Blaxel is a first-class sandbox provider in the OpenAI Agents SDK. Support is available via @openai/agents-extensions/sandbox/blaxel.

Together, these features target agents that need durable working state and procurement-ready isolation.

Pros

Blaxel's advantages show up when agents need stateful execution across long sessions.

• Perpetual standby: Removes compute cost during idle periods. Paying for stopped sandboxes adds up when agents wait between tool calls.
• Firecracker isolation: Gives multi-tenant untrusted code a hardware-enforced boundary under SOC 2 controls. Each sandbox gets its own kernel boundary.
• Enterprise compliance posture: SOC 2 Type II and ISO 27001 are publicly confirmed. HIPAA compliance with a BAA is available.
• Production validation: Includes coding agent customers like Webflow, Vybe, and PR review teams like Delty. Delty resumes sandboxes in 25ms while analyzing around 5,000 pull requests per month.

These advantages matter when enterprise buyers ask for security artifacts and production behavior together.

Cons

The main Blaxel limitation in this comparison is SDK coverage.

• SDK coverage: Covers Python, TypeScript, and Go. Ruby, Java, and Rust teams integrate over the REST API. For teams using those first-class SDKs, this limitation usually doesn't affect evaluation.

Pricing

Blaxel prices sandboxes around usage and standby storage:

• Free: The free plan includes up to $200 in free credits plus usage costs.
• Pre-configured sandbox tiers and usage-based pricing: See Blaxel's pricing page for the most up-to-date pricing information.
• Available add-ons: Available add-ons include email support, live Slack support, and HIPAA compliance.

Standby sandboxes incur storage costs, not compute charges.

Who is Blaxel best for?

Blaxel fits AI-first startups and scale-ups building production coding agents. It also fits PR review agents and data analysis agents that execute code. These teams need to prove compliance during enterprise sales. Teams that maintain state across long agent sessions benefit most from perpetual standby. They stop paying for idle compute without losing filesystem or memory state.

2. Modal

Modal platform is a Python-native serverless compute platform built around GPU workloads. It has a decorator-based SDK. It also uses a custom container runtime tuned for cold-start performance on large models. Modal added sandboxes as an auxiliary product. Teams already running inference or training on Modal can execute agent code there.

Standard Modal sandboxes use gVisor containers for isolation. A VM runtime is available for workloads that need deeper Linux features. Modal supports a broad GPU lineup from T4 through B300. Its memory snapshots expire after 7 days. It also reported over 1 billion sandboxes launched as of May 2026. You can explore its sandbox offering directly.

For SOC 2 purposes, Modal has completed a SOC 2 audit. It offers HIPAA BAAs on the Enterprise plan. gVisor reimplements the Linux syscall surface in user space. That reduces attack surface compared with standard containers. It doesn't provide the hardware-enforced boundary that microVMs give.

Key features

Modal's sandbox features sit alongside its GPU serverless platform:

• GPU-first serverless compute: Modal supports GPUs from T4 through B300. Functions use per-second billing and carry no idle charges.
• gVisor container isolation: User-space syscall interception reduces attack surface. An experimental VM runtime supports eBPF, systemd, and custom filesystem mounts.
• GPU memory snapshots: The alpha snapshot feature captures GPU state. This reduces startup time for model-heavy workloads.
• Multi-language sandboxes: Sandboxes run any language or runtime. SDKs are available for Python, TypeScript, and Go.

Modal is strongest when sandbox execution sits next to GPU inference or training.

Pros

Modal's advantages come from its GPU serverless foundation.

• Scale-to-zero GPU billing: Fits bursty inference and training workloads. That remains Modal's core strength.
• SOC 2 Type II: Completed with no deviations. That helps enterprise procurement.
• Per-second function billing: Tracks actual compute usage by the second.
• Production scale: Over 1 billion sandboxes launched as of May 2026 shows sustained production usage.

Teams should evaluate Modal as a GPU-first compute platform with sandbox support.

Cons

Modal's limitations center on pricing multipliers and portability.

• Pricing multipliers: Headline GPU rates aren't production rates. A 3x multiplier applies to non-preemptible execution. Sandboxes and notebooks also bill above standard function rates. Regional multipliers can further raise effective rates.
• Snapshot expiry: Memory snapshots expire after 7 days in alpha. Longer state gaps require running sandboxes or using Volumes.
• Portability: The decorator-based SDK creates Modal-specific serving logic. Moving workloads elsewhere requires rewriting that logic.

Budgeting Modal requires modeling the workload with multipliers, not only list rates.

Pricing

Modal combines plan minimums with compute rates:

• Starter: Starter costs $0 plus compute. It includes $30 monthly credits, 3 seats, 100 containers, and 10 GPU concurrency.
• Team: Team costs $250 per month plus compute. It includes $100 monthly credits, unlimited seats, and 1,000 containers. It also includes 50 GPU concurrency, custom domains, and static IP.
• Enterprise: Enterprise uses custom pricing. It includes higher GPU concurrency, HIPAA, audit logs, and Okta SSO.
• Sandbox compute: Sandboxes bill at $0.00003942 per core-second and $0.00000672 per GiB-second. Those rates are higher than base function rates. See Modal's pricing page for full GPU rates and multipliers.

The plan minimum matters when sandbox usage is low or sporadic.

Who is Modal best for?

Modal fits teams whose agent workloads include GPU-resident model inference or training. It works best when teams want sandboxes co-located with that GPU compute. If your agents are CPU-bound and state-heavy, the 7-day snapshot expiry works against you. Budget carefully at effective rates, not list rates. GPU workloads carry significant multipliers.

3. Northflank

Northflank platform is a Bring-Your-Own-Cloud (BYOC) platform for general production workloads. It spans AWS, GCP, Azure, Oracle, CoreWeave, bare metal, and on-premises deployments. It deploys any OCI container image with hardware-level isolation. It also has preview-environment-per-pull-request support.

Its primary microVM-backed runtime uses Kata Containers with KVM and Cloud Hypervisor. gVisor is used where syscall-interception isolation is sufficient. gVisor also applies when nested virtualization isn't available. You can review Northflank's sandbox guide and sandbox capabilities.

On compliance, Northflank achieved SOC 2 Type 2. Its security page states it has not experienced a security breach since April 1st, 2019. Its Kata Containers runtime uses KVM and Cloud Hypervisor to provide VM-level isolation. The host kernel is not involved in processing the container's syscalls. The boundary is enforced through VT-x or AMD-V. Persistent volumes survive scale-to-zero. They support disk snapshots and encrypted backups to your own S3.

Key features

Northflank's feature set is broad because it serves general application workloads:

• BYOC across many providers: Northflank deploys to AWS EKS, Azure AKS, GCP GKE, CoreWeave, Oracle Kubernetes, Civo, and custom Kubernetes clusters.
• Kata Containers isolation: VM-level isolation uses KVM and Cloud Hypervisor. Sandboxes boot in under 1 second.
• Extensive networking protocols: HTTP, HTTP/2, WebSockets, gRPC, TCP, and UDP are supported. Optional mutual TLS and Tailscale sidecars are available.
• Persistent volumes with disaster recovery: Volumes survive scale-to-zero. They support disk snapshots and encrypted backups to your own S3.

Northflank gives infrastructure teams a general platform they can adapt for agents.

Pros

Northflank's strengths come from deployment control and infrastructure breadth.

• BYOC deployment: Teams can run workloads inside their own cloud accounts and regions. That BYOC model is Northflank's flagship strength.
• SOC 2 Type 2: Achieved with a clean breach history documented since 2019.
• Kata Containers isolation: Provides hardware-virtualization-based isolation for untrusted code. The approach is similar to microVM isolation.
• OCI image support: Supports any OCI container image without a proprietary packaging step. That reduces application packaging lock-in.

These strengths fit teams that want one platform across many cloud environments.

Cons

Northflank's limitations reflect the complexity of a broad general-purpose platform.

• Database migration documentation: Some users criticized the documentation. The reported guidance centers on logical backup and local download patterns.
• Console complexity: Users praise configurability. Some still describe the console as overwhelming.

These issues don't negate Northflank's BYOC value. They do matter when teams want a narrow agent execution layer.

Pricing

Northflank publishes plan and resource pricing:

• Developer sandbox: The developer sandbox includes 2 services, 2 jobs, 1 addon, and up to 1 BYOC cluster.
• Pay-as-you-go pricing: The pricing page starts at $0 with no seat-based pricing. CPU is $0.01667 per vCPU-hour. Memory is $0.00833 per GB-hour, billed to the second.
• Enterprise: Enterprise uses invoice-based pricing. It includes volume discounts, custom SLA, SSO/SAML/OIDC, audit logs, white labelling, and 24/7 support.

This model suits steady platform workloads more than highly idle agent sessions.

Who is Northflank best for?

Northflank fits teams that want one BYOC platform for applications and agent sandboxes. It is strongest when infrastructure placement matters more than agent-specific lifecycle behavior. Its predefined plans suit steady workloads more than high idle-to-active agent patterns. If you want perpetual standby with sub-25ms resume, evaluate that gap before committing.

4. Fly.io

Fly.io platform is a global application platform that runs workloads on Firecracker microVMs. It converts OCI container images to VMs with full, no-shared-kernel isolation. Fly.io positions itself as a Heroku replacement with a broad regional footprint. Teams control workloads through a Machines API for lifecycle, resources, and region placement.

In January 2026, Fly.io launched its Sprites product for continuous agent operation. Fly proxy auto-starts stopped Machines on inbound requests. Cold starts for typical apps are usually a few seconds. They are not typically under a second. You can look at its Machines and Sprites products.

Fly.io achieved SOC 2 Type 2 through its compliance page. It offers a pre-signed HIPAA BAA and runs hardware in ISO 27001 datacenters. Fly Volumes use Linux block-level encryption. Fly's private networking between hosts uses a WireGuard mesh. Not all platform traffic runs over WireGuard in every case.

Key features

Fly.io's core features target globally distributed application workloads:

• Firecracker microVMs with global reach: Fly.io provides no-shared-kernel isolation across a broad regional footprint. Teams control Machines through REST API or flyctl.
• Auto-stop/start: The Fly proxy can stop or suspend idle Machines. It restarts them on inbound requests, often at subsecond speeds.
• Suspend/resume: Memory-preserving suspend is available. Fly.io doesn't recommend it for Machines with more than 2GB memory.
• Private networking: A WireGuard mesh connects platform components. Dedicated IPv4 and static egress IPs are paid options.

Fly.io gives teams low-level primitives for building distributed systems.

Pros

Fly.io's strengths come from global app deployment and Firecracker isolation.

• Global placement: Teams can run workloads close to end users. That remains Fly.io's flagship strength.
• Compliance posture: SOC 2 Type 2 achieved. Uses ISO 27001 datacenters and offers a pre-signed HIPAA BAA.
• Firecracker isolation: MicroVMs provide hardware-enforced isolation for untrusted code.
• Language flexibility: Any language or runtime packaged as a container image is supported.

Fly.io works well when global placement is the top requirement.

Cons

Fly.io's limitations center on capacity, reliability, support, billing, and CPU performance.

• Regional capacity: Community threads document persistent capacity errors in US regions. Other reports describe insufficient resources when creating Machines with volumes.
• Reliability history: A February outage lasted around 24 hours. During that outage, the status page showed 99.99% uptime. Staff later acknowledged rough reliability across several months.
• Support gating: Community reports describe support limitations for non-paying and lower-tier users. Chat support is gated behind the highest-cost plan tier.
• Billing surfaces: Stopped machine RootFS bills at $0.15 per GB per month. Volume snapshot storage charges started January 1, 2026.
• CPU performance: A community post documents CPU steal below expected performance. The user reported paying for 8 vCPUs while receiving less effective CPU.

These risks matter when agents depend on predictable resume and execution behavior.

Pricing

Fly.io pricing combines compute, storage, networking, and support:

• Compute: Fly.io pricing bills active Machines per second. A performance-1x preset with 1 performance CPU and 2GB RAM runs about $32.19 per month.
• Stopped storage: Stopped Machines bill rootfs storage at $0.15 per GB per month.
• Networking add-ons: Dedicated IPv4 costs $2 per month. Static egress IPs cost roughly $3.60 per month.
• Support: Community is free. Standard costs $29 per month. Premium costs $199 per month. Enterprise starts at $2,500 per month.

Pricing grows as teams add storage, networking, and support requirements.

Who is Fly.io best for?

Fly.io fits teams that want globally distributed container workloads on solid microVM isolation. Those teams should test capacity, support, and billing behavior before production use. The Machines API is an active general-purpose Fly.io product. The agent-specific Sprites product should be tested against your workload before production use. For continuous agent operation with dependable state and resume, verify stability before building on it.

5. E2B

E2B platform is an open-source platform for AI code-execution sandboxes. Each session runs on Firecracker microVMs with a dedicated kernel. Its platform appears geared toward agent development workflows and iterative creation patterns. Official materials also include production-oriented use cases. Those use cases include CI/CD and production build scripts. You can find its sandbox documentation.

On compliance, E2B references "enterprise-grade security" and maintains a Trust Center. Specific SOC 2 Type I or II, HIPAA, or ISO certifications are not confirmed from official sources. For enterprise procurement with hard SOC 2 Type II requirements, this is a disqualifying gap. E2B describes itself as open source. Its public GitHub repositories and docs are accessible. Production teams typically use E2B's managed cloud offering rather than self-hosting.

Key features

E2B's features emphasize open-source sandboxes and paused-state retention:

• Firecracker microVM isolation: Each session gets a dedicated kernel. This is the same hardware-isolation class as Blaxel and Fly.io.
• Filesystem and memory persistence: Pausing saves filesystem and memory state, including running processes and loaded variables. Teams can save filesystem only with keepMemory: false.
• Paused retention: Paused retention is indefinite with no automatic paused-state TTL. Active sandbox duration still has tier caps.
• Public URLs and configurable egress: Every sandbox has internet access by default. Configurable allow and deny lists are available, along with a public URL for running services.

Paused retention helps iterative development, but it should not be read as unlimited active runtime.

Pros

E2B's strengths are most relevant for teams that value open-source infrastructure.

• Open-source access: Public repositories and self-hosting options suit teams building agent prototypes. Teams can inspect the code themselves.
• Firecracker isolation: Hardware-enforced isolation for untrusted code matches the strongest isolation class here.
• Paused retention: Paused sandboxes can remain retained without forced deletion. That helps iterative development workflows.
• Customer base: Includes Hugging Face, Manus, Groq, and Lindy among its users.

E2B is a useful reference point for open-source agent sandbox development.

Cons

E2B's limitations matter when teams move from prototypes to production procurement.

• Runtime caps: Hard sandbox duration caps hit at tier boundaries. Hobby caps at 1 hour, while Pro caps at 24 hours.
• Snapshot edge cases: Filesystem changes can persist after the first resume but be lost after later resumes. This behavior appears in GitHub issue #884.
• Production-scale issues: HTTP/2 closed-state errors under high concurrency. Swallowed Retry-After headers on 429s.
• Pro floor and concurrency: The $150 per month Pro floor applies before the first second of compute. Pro also has a 100-concurrent-sandbox cap.

These limits make E2B harder to fit into strict SOC 2 Type II procurement today.

Pricing

E2B pricing combines a free tier, a paid floor, and usage charges:

• Hobby: E2B pricing includes $0 with a $100 one-time credit. It has a 1-hour max session and up to 20 concurrent sandboxes.
• Pro: Pro costs $150 per month. It has a 24-hour max session and up to 100 concurrent sandboxes. The cap is expandable to 1,100.
• Compute: 1 vCPU costs $0.000014 per second. RAM costs $0.0000045 per GiB-second across all tiers.

The Pro floor is the main pricing difference for low-volume production evaluations.

Who is E2B best for?

E2B fits teams that want open-source infrastructure and self-hosting flexibility for agent prototypes. Its development-focused patterns align with iterative session work. For enterprise production under SOC 2 Type II requirements, the missing confirmed report is a gap. The documented runtime caps also push many teams toward a platform with verified compliance and durable state.

6. Daytona

Daytona platform is an AI agent sandbox provider. It pivoted from developer environments in December 2024. Daytona repositioned around stateful snapshots, fast provisioning, and multi-language SDK control for AI-generated code. It offers four sandbox classes: Container, Linux VM, Windows, and GPU. Container sandboxes use Linux namespaces for isolation. VM sandboxes run full virtual machines with pause/resume and snapshot support. You can review its sandbox classes.

On compliance, Daytona has achieved SOC 2 Type I. It states that HIPAA compliance is in place. One development worth flagging is the closed-source transition. Daytona moved its production codebase to closed source in June 2026.

Key features

Daytona's feature set focuses on sandbox variety and SDK breadth:

• Four sandbox classes: Container, Linux VM, Windows, and GPU cover a range of isolation and OS requirements.
• Sub-90ms creation: Sub-90ms creation supports responsive provisioning. Fast creation applies to pre-built templates.
• VM pause/resume: VM sandboxes freeze the full VM. They preserve filesystem and memory while consuming no CPU.
• Multi-language SDKs: TypeScript, Python, Ruby, Go, and Java SDKs are available. Daytona also provides a REST API.

Daytona is useful when SDK breadth or OS variety drives the evaluation.

Pros

Daytona's strengths come from language coverage and sandbox class variety.

• SDK breadth: Ruby, Go, and Java support fits teams outside Python and TypeScript host applications.
• Fast creation: Sub-90ms creation for pre-built templates supports responsive agent provisioning.
• Stateful VMs: VM-class sandboxes offer pause/resume with memory preservation for stateful workloads.
• Credits: Offers up to $50,000 in credits, plus $200 in free compute to start.

These strengths fit teams that need sandbox variety more than Type II compliance today.

Cons

Daytona's limitations center on lifecycle reliability, packaging, and documentation gaps.

• Closed-source transition: Daytona moved its production codebase to closed source. The previously public GitHub repository now says it is no longer maintained.
• Initialization failures: Open issues document sandbox initialization failures with default templates and custom resources. Other reports include GitHub connection refused errors.
• Package access: apt-get failures due to inaccessible Debian package repositories.
• SDK bugs: A Python SDK issue reports serialization failures when snapshot.to_json() encounters datetime objects.
• Documentation gaps: Missing authentication documentation for DockerHub and GHCR workflows.

These issues deserve close testing before production dependence.

Pricing

Daytona publishes pay-as-you-go resource pricing:

• Free tier: The free tier includes $200 in free compute and requires no credit card.
• Pay-as-you-go: vCPU costs $0.0504 per hour. Memory costs $0.0162 per hour. Storage costs $0.000108 per GiB-hour, with the first 5 GiB free.
• Enterprise: Enterprise includes SSO, audit logs, and BYOC through sales.

Pricing is straightforward, but procurement teams still need to weigh the Type I status.

Who is Daytona best for?

Daytona fits teams that need broad language SDK coverage or specific sandbox classes. Windows VMs and GPU classes are examples. It also fits teams that are comfortable with SOC 2 Type I while Type II completes. The closed-source transition and open issues around sandbox initialization are worth weighing. If procurement demands Type II today, evaluate that requirement against Daytona's current status.

Comparison table

Use this table as a quick screen before you run a proof of concept. The details in each provider section explain the tradeoffs behind each row.

For a rough active-compute baseline, compare 1 vCPU and 2GB RAM for one active hour. This excludes storage and support. Modal's published sandbox rates come to about $0.1903 for that hour. Northflank's published CPU and memory rates come to about $0.0333. E2B's published compute rates come to about $0.0828. Fly.io's closest listed preset is about $32.19 per active month. That preset includes 1 performance CPU and 2GB RAM. Blaxel doesn't publish a comparable per-vCPU line in this article. Compare it through a workload quote or usage estimate. Idle behavior, storage, plan minimums, and support tiers still decide the real bill.

How to choose

Let the criterion that carries the most procurement risk dominate your decision. If enterprise deals require a SOC 2 Type II report today, that filter removes E2B and Daytona. E2B's certification is not confirmed. Daytona has Type I only. That leaves Blaxel, Modal, Northflank, and Fly.io.

Among those, stateful CPU-bound agents benefit from perpetual standby and microVM isolation. GPU-heavy workloads point toward Modal. Teams committed to their own cloud accounts should evaluate Northflank's BYOC breadth. Teams that need global application placement should test Fly.io's reliability and support model closely.

Choose the right execution layer for your SOC 2 compliant AI agents

The sandbox layer is where tenant isolation, egress control, and audit trails pass review. It is also where weak controls stall the deal. Choosing the right SOC 2 compliant sandbox provider requires two checks. Match verified compliance with the right isolation and state model.

For AI-first teams building production coding agents, PR review agents, and data analysis agents, the combination is specific. You need confirmed compliance and infrastructure designed for agent code execution from the start. Blaxel delivers SOC 2 Type II and ISO 27001 certifications. HIPAA compliance is available through a BAA.

Blaxel Sandboxes use Firecracker microVM isolation and give each sandbox its own kernel. Perpetual standby preserves filesystem and memory state without ongoing compute charges. Snapshot and volume storage are still billed. Standby resumes in under 25ms. Network-based auto-shutdown returns sandboxes to standby around 15 seconds after connections close.

Blaxel also covers the surrounding agent infrastructure. Volumes provide durable block storage for long-term data retention. Agent Drive, in private preview, provides shared storage for context and artifacts across agents and sessions. Managed networking includes custom domains and dedicated egress gateways in private preview. In a proof of concept, verify audit scope, egress policy, standby behavior, and storage billing. Match each check against your workload. See how the full Blaxel platform handles compute, storage, and networking for agents.

FAQs about SOC 2 compliant sandbox providers

These answers cover the procurement and architecture questions teams usually ask after comparing providers.

Why does the isolation model matter for SOC 2 compliance?

SOC 2 CC6.1 covers logical and physical access controls. Auditors require proof of tenant isolation through architecture, configuration, tests, and logs. Policy alone is not enough. For untrusted AI-generated code, the isolation model determines what a container escape can expose. A container escape gives an attacker root on the shared host kernel. A microVM escape requires a rare hypervisor vulnerability. Those vulnerabilities command $250,000 to $500,000 bounties. Hardware-backed isolation like Firecracker microVMs supports CC6.1. It places the boundary at the hypervisor and CPU level.

Is SOC 2 Type II enough for a regulated production deployment?

Not by itself. SOC 2 Type II verifies operating effectiveness over a review period. That makes it the enterprise procurement default. It doesn't cover every regulated requirement. For protected health information, you need a signed HIPAA BAA. For EU personal data, SOC 2 doesn't satisfy residency obligations. You'll need a General Data Protection Regulation (GDPR) Data Processing Agreement to supplement it. Always verify the audit scope covers production systems. Also check the report's User Entity Controls. They define the security responsibilities you must implement.

How does perpetual standby affect compliance and cost?

Perpetual standby lets a sandbox hold complete filesystem and memory state indefinitely. It carries zero compute charge while idle. It then resumes in under 25ms. For compliance, long-running agent sessions keep their audit context and working state intact. The agent doesn't need to re-initialize environments between tool calls. For cost, perpetual standby changes spend on agents with high idle-to-active ratios. Platforms that charge for stopped machines or delete state after fixed windows force a tradeoff. You either pay for idle compute or rebuild state on every resume. Blaxel is the only provider in this comparison with perpetual standby plus sub-25ms resume. That standby preserves complete filesystem and memory state with zero compute charge under its stated compliance posture.

What networking controls should a compliant sandbox enforce?

Default-deny egress is a core defense against data exfiltration. Outbound traffic should route through a controlled proxy with an explicit allowlist. Under that model, a prompt-injected agent can't send data to arbitrary servers. Access to cloud metadata endpoints also stays blocked. For any agent handling sensitive data in a multi-tenant environment, require explicit egress allowlisting or proxying. Blaxel ships proxy-based egress and custom domains. Dedicated egress gateways for static outbound IPs are in private preview. That lets teams whitelist outbound traffic without building the networking layer themselves.

Which providers have confirmed SOC 2 Type II as of mid-2026?

Based on official sources, Blaxel, Modal, and Northflank have confirmed SOC 2 Type II. Fly.io has confirmed SOC 2 Type 2. Blaxel and Fly.io also hold ISO 27001, with Fly.io at the datacenter level. Modal and Fly.io offer HIPAA BAAs. Daytona has achieved SOC 2 Type I with Type II in progress. It doesn't meet a hard Type II requirement yet. E2B references enterprise-grade security and maintains a Trust Center. No SOC 2, ISO, or HIPAA certification is confirmed from official sources. Always request the actual report and verify the audit scope covers production systems before relying on any badge.