Sandbox guide

CapabilitiesThe company

Data processing agreement

A GDPR data processing agreement is offered.

10 yes2 with a catch0 no4 not published

Who offers it

Part of Who is behind it, which explains why it matters.

Fully: boxd, Cloudflare Sandbox, Daytona, E2B, Lizard, Modal, Runtime, Sprites, Tensorlake and Vercel Sandbox. With a catch: Boat and Sandboxer.

  • boxdYes

    A data processing agreement is part of the contract where it applies.

    docs-confirmed “Data Processing Agreement” Source

  • Cloudflare SandboxYes

    Cloudflare publishes a standard customer DPA that covers its services.

    docs-confirmed “Data Processing Addendum” Source

  • DaytonaYes

    A public DPA names the supervisory authority and the subprocessor notice period.

    docs-confirmed “Data Processing Agreement” Source

  • E2BYes

    A DPA template is served with the trust-centre documents.

    docs-confirmed “served with the DPA template” Source

  • LizardYes

    A public DPA is linked, and a signed DPA with security review comes with Enterprise.

    pricing-page “Signed DPA and security review” Source

  • RuntimeYes

    The DPA is part of the terms for every account.

    pricing-page “A data processing addendum that is part of the terms for every account” Source

  • SpritesYes

    The DPA is self-service on every plan and covers Sprites.

    docs-confirmed “The DPA is available to every organization on every plan” Source

  • TensorlakeYes

    A public DPA with a dated revision is published.

    docs-confirmed “Data Processing Addendum” Source

  • Vercel SandboxYes

    A public DPA applies to Enterprise and Pro customers.

    docs-confirmed “Data Processing Addendum” Source

  • BoatWith a catch

    The catch: You have to email support to get a data processing agreement.

    docs-confirmed “To request a data processing agreement, contact support@ascii.dev.” Source

  • SandboxerWith a catch

    The catch: You have to write to privacy@ to get a data processing addendum.

    docs-confirmed “If you need a Data Processing Addendum, write to” Source

  • Agent 37Not published

    No data processing agreement is published or referenced in the terms.

    docs-confirmed “These Terms of Service” Source

  • BlaxelNot published

    No public DPA is linked from the terms, security or pricing pages.

    docs-confirmed “Last updated December 10, 2025” Source

  • InstaBoxNot published

    No DPA page or reference appears on the site; the terms point to a Trust Center instead.

    docs-confirmed “InstaBox gives each agent a Linux machine of its own in the cloud.” Source

  • MorphNot published

    No DPA page or reference appears in the terms; it offers security attestations on request instead.

    docs-confirmed “we'll provide available third-party security attestations” Source

Related

Other capabilities in this feature

Where it decides the choice

The feature

Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.