---
title: "Security and compliance"
description: "E2B is SOC 2 Type II compliant and signs HIPAA BAAs on Enterprise plans. Every sandbox runs in its own Firecracker microVM. How to get the SOC 2 report, bridge letter, pen test, and DPA."
url: "https://e2b.dev/security"
---

# Security and compliance

> E2B runs untrusted, AI-generated code in isolated cloud sandboxes. This page states E2B's compliance status, what an independent auditor has verified, and how to get the underlying reports.

E2B is SOC 2 Type II compliant. E2B signs HIPAA Business Associate Agreements on Enterprise plans. Every sandbox runs in its own Firecracker microVM, so code from one customer cannot read or reach another's. E2B's contracting entity is FoundryLabs, Inc., a Delaware corporation.

## SOC 2 Type II

E2B maintains a SOC 2 Type II report. The report is available under NDA from the E2B Trust Center at https://trust.e2b.dev, along with a current bridge letter.

A SOC 2 Type II report tests whether controls operated effectively across an entire audit period, rather than whether they were designed correctly on a single day. When a period ends, E2B publishes a bridge letter covering the gap until the next report is issued.

SOC 2 does not certify a product; it attests that an independent auditor tested E2B's controls and found them operating as described.

### Documents

- SOC 2 Type II Report: request access at https://trust.e2b.dev, under NDA.
- SOC 2 Bridge Letter: opens at https://trust.e2b.dev, no request needed.
- Penetration Test: request access at https://trust.e2b.dev, under NDA.
- Data Processing Addendum: request access at https://trust.e2b.dev.
- Certificate of Liability Insurance: request access at https://trust.e2b.dev.
- HIPAA Business Associate Agreement: email trust@e2b.dev.
- Subprocessor list: email trust@e2b.dev.
- Completed security questionnaire: email trust@e2b.dev.

## HIPAA

- Does E2B sign a HIPAA Business Associate Agreement (BAA)? Yes. E2B signs a HIPAA Business Associate Agreement on Enterprise plans. Email trust@e2b.dev to start one.
- Can I process PHI on E2B? Protected health information may be processed on E2B under a signed Business Associate Agreement, on Enterprise plans. Without a signed BAA in place, do not send PHI to E2B sandboxes.
- Is E2B HIPAA compliant? Yes. E2B supports HIPAA-regulated workloads under a signed Business Associate Agreement, which E2B offers on Enterprise plans. E2B maintains the technical safeguards the HIPAA Security Rule requires: encryption in transit and at rest, unique account authentication, restricted production access, audit logging, and per-sandbox microVM isolation. Those controls are independently tested under SOC 2 Type II. There is no such thing as a HIPAA certificate; HHS runs no certification program for any vendor. HIPAA compliance is a property of how a covered entity and its business associate operate together, and the BAA is what establishes it.

## Isolation and tenancy

Every E2B sandbox runs in its own Firecracker microVM with its own kernel. Isolation is at the hypervisor boundary, not the container or process boundary, which is what makes it safe to run untrusted or AI-generated code. Sandboxes never share a kernel, a filesystem, or memory with another customer's sandboxes.

Sandboxes are destroyed on timeout or shutdown. Filesystem and memory state can be preserved across a pause and restored on resume.

## Where sandboxes run

E2B's managed sandboxes run on Google Cloud. Sandbox storage sits under Google Cloud's default encryption at rest; E2B adds no encryption layer of its own and holds no key material for it. Traffic to and from sandboxes is encrypted with TLS. Available regions, and the plan each is available on, are listed at https://docs.e2b.dev/faq/egress-ip-ranges.

## Bring Your Own Cloud (BYOC)

BYOC deploys E2B sandboxes inside your own VPC, in your own AWS or Google Cloud account. BYOC is available on Enterprise plans. Azure is not yet supported.

Under BYOC, sandbox traffic, template build sources, snapshots, and logs stay inside your VPC and never reach E2B Cloud. Only anonymized cluster CPU and memory metrics are sent to E2B. Traffic between E2B Cloud and your VPC is TLS-encrypted, and VPC peering is available. Storage lives in your account, under your own encryption, retention, and access controls.

For a regulated workload this means the data residency, key management, and audit logging that apply are your own. E2B's SOC 2 Type II report covers the E2B software and control plane; the cloud account it is deployed into, and that account's compliance posture, remain yours. BYOC is a managed deployment in your account, not self-hosting.

## Controls

E2B's security controls are continuously monitored with Vanta, spanning infrastructure security, product security, organizational security, internal security procedures, and data privacy. Each control and its current status are published at https://trust.e2b.dev/controls.

E2B commissions independent penetration testing, and the report is available under NDA. Customer data is deleted when a customer leaves. E2B offers a Data Processing Addendum for GDPR; request the template from the Trust Center, or email trust@e2b.dev for a signed copy.

## Security and compliance questions?

Email trust@e2b.dev for a BAA, a signed DPA, a completed security questionnaire, the subprocessor list, or to report a security vulnerability. Contact E2B before running any test against E2B; the terms of service at https://e2b.dev/terms require prior written consent.