Station guide / 03
Security & credentials
What the Station control plane stores, what remains on your machine, and the boundaries that keep customer work isolated.
Two systems, two kinds of data
Control plane
Account identity, signed sessions, Station configuration, lifecycle status, job state, and an event log.
Your Station
Repository files, terminal sessions, agent configuration, and credentials created by provider CLIs.
Isolation starts in the schema
Every Station belongs to a Planet, and every Planet belongs to the Solar System owned by one authenticated user. API queries derive that ownership from the signed session; the browser cannot submit another owner or tenant identifier to widen access.
Sessions and passwords
BetterAuth owns password hashing and session cookies. Cookies are HTTP-only and signed; a short-lived signed cache reduces repeated database reads. Changing a password can revoke every other session. Secrets enter production through Defang configuration, never source control.
Lifecycle safety
- Creation, retries, and destruction become uniquely keyed durable jobs.
- Lifecycle revisions prevent stale work from overwriting a newer decision.
- Each visible transition is appended to the Station event log.
- Destruction requires typing the Station name exactly.
Deleting an account
You must destroy every active Station first, then type your email and re-enter your password when applicable. The server refuses account deletion while an active Station remains so a future cloud machine cannot be orphaned. Database cascades then remove the hidden tenancy, sessions, configuration, jobs, and history.
Security promise
Your Anthropic and OpenAI credentials do not pass through the Station control plane.