How Karta runs.
Two planes with an internal API between them. Every session gets its own microVM, the workspace sits under per-tenant keys, and in BYOC the entire data-plane boundary moves into your cloud.
Every dashed line is a boundary.
Two planes
The control plane runs identity, releases, billing, and audit. The data plane runs sessions, workspaces, and model traffic. They talk only over the internal API - so the data-plane boundary can move into your cloud without touching the control plane.
One microVM per session
Karta assumes agent code and inputs can be hostile. Every session runs the native harness in its own isolated microVM - never in a shared process.
Keys at tenant grain
The durable workspace store sits under per-tenant keys with crypto-shredding and customer-managed keys - we are validating this capability with design partners now.
Egress under control
Model traffic leaves through connector and model routing - platform keys or yours - and everything is metered per user on the way out.
The full security story - isolation, tenancy, encryption, audit, sub-processors - lives on the trust page and in the security docs.
Questions about the boundaries?
Security reviews welcome. Talk to security, or ask about BYOC.