Sandbox guide

CapabilitiesThe company

SOC 2 report

An independent security audit report you can request.

6 yes4 with a catch3 no3 not published

Who offers it

Part of Who is behind it, which explains why it matters.

Fully: Blaxel, Cloudflare Sandbox, Daytona, E2B, Modal and Tensorlake. With a catch: Agent 37, Runtime, Sprites and Vercel Sandbox. Not at all: Boat, boxd and Lizard.

  • BlaxelYesSOC 2, HIPAA, ISO

    A SOC 2 report is available on request from the compliance portal.

    docs-confirmed “SOC 2, HIPAA, ISO 27001” Source

  • Cloudflare SandboxYes

    Cloudflare holds a SOC 2 Type II report, but no Sandbox-specific scope is published.

    docs-confirmed “AICPA SOC 2 Type II” Source

  • DaytonaYesType II

    A SOC 2 Type II report covering December 2025 to March 2026 is available from the trust centre.

    docs-confirmed “on July 28, 2026 with an unqualified opinion covering the period December 16, 2025” Source

  • E2BYesType II

    A SOC 2 Type II report is available on request through the trust centre.

    docs-confirmed “E2B has a **SOC 2 Type II** report.” Source

  • TensorlakeYesType 2

    A SOC 2 Type 2 report is available through the trust centre.

    docs-confirmed “Tensorlake is SOC 2 Type 2 certified.” Source

  • Agent 37With a catchType I only

    The catch: Only a SOC 2 Type I report is available, on request; Type II is still in progress.

    docs-confirmed “SOC 2 Type I and readiness reports on request.” Source

  • RuntimeWith a catch

    The catch: The SOC 2 and ISO certificates belong to its Virginia data centre, not to Runtime, so there is no Runtime-owned report.

    The certificates name the data centre, not Runtime.

    docs-confirmed “SOC 1, SOC 2 and SOC 3 Type 2; ISO 27001” Source

  • SpritesWith a catch

    The catch: Fly's SOC 2 report describes the platform and does not name Sprites.

    docs-confirmed “The report describes the Fly.io platform; it does not name individual products such as Sprites” Source

  • Vercel SandboxWith a catch

    The catch: Vercel holds SOC 2 Type 2, but Sandbox's place in the audit scope is not published.

    docs-confirmed “Vercel has a SOC 2 Type 2 attestation” Source

  • BoatNo

    Note: SOC 2 is in progress, so there is no report to request yet.

    docs-confirmed “SOC 2 in progress.” Source

  • boxdNo

    Note: boxd says it is working on SOC 2 and ISO 27001 and offers security details by email instead.

    docs-confirmed “We're working on both.” Source

  • LizardNo

    Note: The SOC 2 report is listed as coming soon.

    pricing-page “SOC 2 report (coming soon)” Source

  • InstaBoxNot published

    The Trust Center shows a HIPAA badge and no SOC 2 report is claimed on the site.

    pricing-page “HIPAA BAA” Source

  • MorphNot published

    The terms promise attestations on request, but no SOC 2 report naming Morph Labs is published.

    docs-confirmed “we'll provide available third-party security attestations” Source

  • SandboxerNot published

    No SOC 2, ISO 27001 or HIPAA statement appears in the security page or terms.

    docs-confirmed “with a description, the steps to reproduce, and the impact you think it has.” Source

Related

Other capabilities in this feature

Where it decides the choice

The feature

Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.