The short version. Operly runs on managed cloud infrastructure. On Pro and Business, your team works on a dedicated virtual computer, one per account, whose screen and terminal only you can open. Our provider keys and your Gmail and Calendar tokens stay on our servers, and the computer asks Operly to act. Teammates stop for your approval before paying, accepting legal terms, or deleting Operly documents. They can send email and change other data you have granted without a card, so read the limits below.
Looking for what is sent to AI companies, what we store, and how to export or delete your data? See Privacy and your data.
Overview
Operly has three layers. The apps (web, iPhone and Android) talk to Operly’s servers. The servers check your sign-in, apply your plan’s limits, hold the keys, and call outside services. A workspace computer is where AI teammates do hands-on work such as browsing and files, and it asks Operly’s gateway and tools to act.
Your workspace computer
The workspace computer is on the Pro and Business plans, one per account. It is where your teammates browse, work with files and run commands.
| Topic | How it works |
|---|---|
| What it is | A dedicated virtual machine that belongs to your workspace, created the first time a teammate needs it. It is on the Pro and Business plans, and each account has one computer. |
| When idle | It pauses when idle and resumes when your team needs it. Files stay on its disk while it is paused. |
| Who can open it | Only the workspace owner, from inside Operly: the Screen and Terminal tabs. |
| Signed-in websites | Sites you sign in to on the computer stay signed in on that computer’s disk until you sign out there. |
| Versions | You can save and restore versions of the computer’s disk. |
Pausing keeps everything. Deleting your account removes your workspace data, files and the cloud computer.
Credentials
The computer is a normal Linux machine, so it holds some credentials and not others. This is where each one lives.
| Credential | Where it lives |
|---|---|
| Operly’s provider keys | Our servers only. They are never placed on your computer. |
| Gmail, Calendar and similar connected-app tokens | Our servers. The computer asks Operly to act, and gets the result. |
| A connected GitHub token | Handed only to commands that work inside cloned code repositories or run git, when you have connected GitHub. It is not written to the computer’s disk. |
| The computer’s own credentials | Short-lived, signed and scoped to one workspace. |
| Website sign-ins and saved passwords | In the browser profile on the computer’s disk, like a normal computer. |
Credentials you type into websites are masked in the activity feed.
Actions and approvals
Operly can act for you: draft, send, schedule and organize. What asks first depends on who is acting and your plan.
| When | What happens |
|---|---|
| A team member you hired sends an email or schedules an event in chat | You see a card for that exact action. It works once. |
| In chat, a teammate deletes a calendar event | A card appears in every chat. |
| A teammate on the computer reaches a payment step, legal terms or sign-up consent to accept, or deletes Operly documents | It stops and asks you first. Payment approvals are tied to the exact action, amount and site, and document deletions to the exact documents. |
| Your chief of staff | Follows your wording. Say “draft it” when you want to read before anything is sent. |
| Your team on the Pro or Business plan | Your team carries out the sends you ask for, so ask for drafts when you want to read first. Teammates on the computer also carry out other requested data changes without an approval card. |
An approval controls the proposed action. It does not undo work already done. You can press Stop on a teammate at any time; that ends its current run and cancels anything you typed to it that was still waiting.
Network and model traffic
- Requests our servers make on your behalf to addresses you provide are checked so they cannot reach private or internal addresses.
- Model requests from the computer go through Operly, which applies your plan’s limits and keeps provider credentials on our side.
- The computer’s browser and commands reach the internet like a normal machine. We do not yet publish an outbound network policy or a fixed outbound address for workspace computers.
Custom tools
- You can connect your own tool servers. Remote tool servers must be public HTTPS endpoints.
- The first use of a custom tool asks for your approval for that exact action. Actions that change something ask every time.
- You can remember approval for read-only tools you trust. If a tool’s definition changes, the remembered approval is reset.
- A custom tool that runs as a command on your workspace computer has access to that computer’s files and network.
Accounts and sign-in
- Sign-in uses a managed authentication service. You can sign in with email and password or with Google, and reset your password by email.
- You can turn on two-factor sign-in with an authenticator app in Settings. It is optional. There are no recovery codes: if you lose your device, we verify your identity before resetting it.
- Every request to our API carries your sign-in token and is checked before any data is returned.
Keeping workspaces apart
- Database access rules are enabled on our data tables, so signed-in browser sessions can only reach their own workspace’s rows.
- Our API checks which workspace a request belongs to before it reads or writes anything. Isolation on the API rests on those checks in our code.
- Each workspace computer belongs to one workspace.
- Agencies can be given delegated access to sub-account workspaces.
Transport and encryption
- The Operly web app is served only over HTTPS, and browsers are told to insist on it.
- The app sets a content security policy that limits where scripts can load from.
- Our database and file storage run on a managed hosting provider that states all customer data is encrypted at rest with AES-256 and in transit with TLS.
Limits, monitoring and support access
- Commands on the computer have per-command time limits. A monthly usage budget, with an optional extra-usage cap you set, protects you from runaway automation and surprise bills.
- You can watch what your team does on the computer as it happens, and review what each teammate did in its conversation. Sensitive values are masked in the activity feed.
- When a workspace computer fails and cannot repair itself, it raises an alert for our team. We can place a hold on a workspace that stops its computer from taking new work.
- Errors are captured for review. In the browser, request contents are filtered out and any session replay masks all text.
- Admin actions are recorded with who, when and from where.
- Only a super admin can sign in as a customer to help with a support request. Every support sign-in is logged, and the session ends after 4 hours.
Hosting
Operly runs on major cloud infrastructure providers: a global edge host for the web app, cloud servers for the API, tools and routines, a managed database with authentication and file storage, a managed cache, and a managed provider for workspace computers. Credentials are kept in a secrets manager, not in source code, and we run separate staging and production environments. Our database and file storage are in the United States. We do not yet publish regions for the other components.
Assurance
We ran an automated OWASP ZAP security scan in preparation for Google’s app security assessment. We have not published a SOC 2 report or independent penetration test results. We will list certifications here when we hold them, naming who issued them.
What we do not promise
- Teammates on the computer carry out requested sends and data changes without an approval card, and your chief of staff can carry out sends you ask for. Ask for drafts when you want to read first.
- Teammates can run commands on the computer. The virtual machine is the boundary, not each command.
- The computer can reach the internet, and we do not yet publish an outbound network policy.
- We do not offer an exportable audit log of everything a teammate did on the computer.
- We cannot control how an AI company keeps or logs a request once it receives it.
- Treating outside text as data, and asking for approval on the actions that matter most, reduces prompt injection. It does not eliminate it.
Questions and reviews
For security reviews, data processing agreements or technical questions, email support@getoperly.ai and we will get you what you need.