SOC2-Compliant Agent Execution from Day One
Run browser agents, desktop agents, and agentic workflows on infrastructure that meets enterprise compliance requirements without custom engineering. Convox Rack deploys into your own AWS, GCP, or Azure account with full CloudWatch audit logging, encryption at rest, and the security controls your compliance team demands. Your agents, your cloud, your audit trail.
Isolated Containerized Agent Environments
Spin up hundreds of isolated agent instances, each running in its own secure container with VNC/noVNC access on ports 5900 and 6080. Define agent services in convox.yml with dedicated CPU, memory, and network isolation—no shared state, no cross-tenant contamination. Each agent process gets its own resource guarantees via scale.cpu and scale.memory settings.
Multi-Tenant Architecture for Agent Products
Deploy customer-facing agent environments across isolated Racks with complete resource separation. Convox's BYOC model gives each tenant their own compute and networking while you maintain centralized control through a single Console and CLI. Perfect for platform teams building AI agent products that serve multiple enterprise customers with strict data isolation requirements.
Scale Agent Fleets from One to Thousands
Go from a single agent to a thousand with scale.count ranges in your convox.yml. Auto-scaling based on CPU or memory targets ensures you have capacity when workflows spike, while scaling down during idle periods keeps costs predictable. Instant rollbacks with convox releases rollback if an agent deployment fails—no manual intervention required.
Deploy Any Agent Framework Without Lock-In
Browser Use, Playwright, Puppeteer, Anthropic Computer Use, or custom agent code—if it runs in a container, it runs on Convox. Define your agent's Dockerfile, expose noVNC ports in convox.yml, and deploy with convox deploy. No proprietary SDKs, no framework restrictions, no vendor lock-in to worry about.
Private Networking for Agent-to-Backend Communication
Keep agent-to-agent and agent-to-backend traffic off the public internet with internal services. Set internal: true in your convox.yml to create services accessible only within your Rack. Combined with VPC isolation and rack-to-rack peering, your agents communicate securely without exposing endpoints to external threats.
