Security
How renters and providers are kept apart
What's in place today, and what's still being built. We'd rather tell you now than have you find out later.
In place
What protects each side today
- Isolated containers
- Renter jobs run inside Docker containers on the provider's machine, not as programs on the provider's Windows desktop.
- No administrator rights
- Containers run as a non-root user with extra privileges removed.
- No access to the provider's files
- No folders from the provider's computer are shared into the container.
- No open ports
- The Productify Node app connects out to Productify over an encrypted connection. Providers don't open ports on their router.
- Wiped after each job
- When a rental stops, its container and files are deleted.
- Machine checks
- Hardware is reported by the app on the machine itself, and every machine is reviewed before renters can see it. Offline machines can't start new rentals.
- Paired machines only
- Each machine has its own pairing token. Only paired, approved machines receive jobs.
Not finished yet
Known gaps
- Blocking home-network access
- Stopping renter jobs from reaching other devices on the provider's local network is still being built. Providers should keep sensitive devices on a separate network for now.
- Signed installer
- The Productify Node installer isn't code-signed yet, so Windows may show a warning when you install it.
- Independent review
- Productify's isolation hasn't had an external security audit yet.
Good practice
During the beta
- Renters: the provider owns the hardware. Don't upload secrets or data you can't afford to expose.
- Providers: don't run Productify Node on a computer that holds sensitive work data.
- Found a problem? Email abuse@productifynow.com. See contact for other addresses.