Security

Floor connects the Claude Code sessions your team is already running, so the honest version of this page matters more than a reassuring one — and the honest version changed when the agents moved onto your machines. Below is what we hold, what we do not, what other people in your room can reach, and what we have not built yet.

Where the model runs

We never front inference, and now we hold no key at all: Your agents run in your own Claude Code, on your own machine and your own subscription. There is no key to give us, so there is none to encrypt, none to leak and none for us to lose. Floor holds no inference account and there is no model API key in this application's environment.
Your machine runs the code, not ours: Floor no longer runs a sandbox, a container or a virtual machine for you. The tools run where you are sitting, under Claude Code's own permission prompts, against your own checkout.

What other people in your room can do

This is the part to read twice: Because your agent runs on your machine, somebody else in your room can affect what happens on it. That is the feature. It is also the thing to understand before you invite anyone: this is a tool for people who already work together, not a public room.
Stopping is free. Steering asks.: Anyone in the room can stop your agent instantly and without your permission, because stopping only ever takes instructions away. Sending it an instruction is different — it arrives as a question, your agent asks you before acting on it, and Claude Code's own tool permissions still apply underneath.
Nobody gets in without being let in: An invite code alone gets somebody nowhere. They ask to join under a name, and a person already in the room approves or rejects them. The room's owner can remove anyone at any time, which stops their agents and frees whatever files those were holding.
You cannot put an agent on somebody else's machine: An agent is always spawned by, and runs on, the machine that created it. There is no way to start one on a teammate's laptop, and no way to report work as an agent that is not yours.

Your code

What we store: Two things, both of which are your source code and both of which we would rather you knew about than discovered:
The room's log. Every change an agent made is recorded as a diff, with the file paths it touched and the terminal output it produced. This is what makes a room replayable, reviewable and forkable, and it is the product.
The checkpoint. When a room goes idle we release its machine and keep its git state — the branch, the commit it started from, and the uncommitted diff — so the work resumes exactly where it stopped.
What we do not store: No copy of your repository, and no disk image. A room checks the repository out inside its own ephemeral virtual machine, which is destroyed when the room suspends. What survives is the git state above — kilobytes, not gigabytes.
How long: For as long as the room exists. Closing a room revokes access for everyone but deliberately keeps the record for its owner — that is the difference between closing and deleting. Deleting a room is not self-serve yet: ask us and we will do it. We would rather say that than imply a button exists.
Analytics never see it: We use product analytics with session replay. Every element that renders your content — the workspace pane, diffs, terminal output, file trees, the composer — is marked so it is masked before a recording leaves your browser. Replay tells us which panes people use; it never carries what is in them.

Who can read a room

Deny by default: Every room-scoped table has row-level security, and every policy is keyed on being a participant in that room. It is enforced by the database rather than by application code, so a bug in a page cannot widen it. The public home page proves it on every load: it queries rooms with no session and must get zero rows.
Guests see the conversation, not the code: Someone invited as a guest can read the room and answer questions but cannot open the workspace, and that is a database policy, not a hidden button.
Closing means closing: Closing a room removes every participant except its owners, revokes every live invite link, and stops the agents. No new agent can be started in it and no fresh link can be minted for it. This is why rooms have their own links rather than one permanent per-project URL.
Only one room can ever be public: A room can be published as a public recording, by its owner, after being told exactly what that discloses. At most one room in the whole system can be public at a time, enforced by a unique index.

Your repository

GitHub access: Floor connects through a GitHub App you install, on the repositories you choose. Tokens are short-lived and minted per operation; we store the installation, not a personal access token. Agents push to a branch and open a pull request — nothing is written to your default branch.

What we do not have yet

Floor is early and run by a very small team. There is no SOC 2 report, no penetration test to show you, no SAML or SCIM outside an enterprise conversation, no configurable data-retention policy, and no self-serve way to delete a room — that one is a support request today. If your security review needs any of those, we would rather tell you now than halfway through it.

Found something wrong here, in the writing or in the code? Tell us and we will fix it and say what changed.