MyClaw Host

The homepage claims 'Dedicated OpenClaw instance per user or team' and 'Strict isolation of agents, sessions, and data' under 'Strong Privacy and Isolation.' The FAQ states 'Every customer gets a dedicated and isolated OpenClaw instance. There is no shared runtime, data, or agent context between users.' However, these are marketing claims with no technical specifics — no mention of how isolation is achieved (containers, VMs, etc.), no encryption-at-rest details, no data retention policy, and no mention of whether data is used for training. The privacy policy is a generic template that refers to 'This App' and mentions phone/device storage, suggesting it was not written for this service.

The homepage mentions 'controlled adapters with allowlists, pairing, and sandboxed execution to ensure safety' under 'Safe Channel Integrations.' However, there is no detail on what sandboxing technology is used, no mention of prompt injection defenses, no human-in-the-loop workflows, no memory integrity protection, and no discussion of container escape prevention. The single vague reference to 'sandboxed execution' is the only relevant claim.

No information found anywhere on the site about how API keys, bot tokens, or other credentials are stored, encrypted, rotated, or protected. The privacy policy makes no mention of credential handling. The FAQ does not address credential security. There is no documentation or security page.

The FAQ mentions 'controlled access, channel-based permissions, and sandboxed agent sessions' for teams. The 'How OpenClaw Works' section says agents 'understand rules, permissions, and intent before responding or taking action.' However, there is no mention of rate limiting, spending caps, kill switches, behavioral monitoring, least-privilege enforcement, or high-risk tool gating. The claims are high-level marketing language.

The FAQ states 'You can export configurations and move to your own self-managed setup at any time' regarding migration, and mentions 'We continuously monitor uptime and health. Services are automatically restarted and issues are handled by our team.' The 'Always Available' section claims '24/7 monitoring and health checks' and 'Automatic restarts and recovery.' However, there is no mention of backups, data retention, SLAs, disaster recovery, or what happens if the provider shuts down. The data export claim is vague.

No pricing information exists anywhere on the site. There is no pricing page, no tier information, no mention of costs, billing, spending caps, or usage monitoring. The 'Deploy Now' and 'Join Waitlist' buttons are non-functional (link to '#'). The terms of service make no mention of pricing, refunds, or billing.

No information found about audit logging, incident response, breach notification, jurisdiction of data storage, GDPR compliance, or agent action audit trails. The privacy policy is a generic mobile app template that does not address any of these topics. The terms of service contain no liability framework specific to AI agent hosting. There is no mention of where data is stored geographically.

No information found about dependency management, MCP server vetting, AI provider data policies, SBOM, build pipeline security, or update verification. The 'Managed Stability and Updates' section says 'We ensure the system stays updated, monitored, and optimized' but provides no details on how updates are vetted, tested, or deployed.

The site uses HTTPS (TLS). The homepage mentions 'security hardening' in the FAQ answer about what they manage, and 'Security-first defaults applied automatically.' However, there is no mention of MFA, authentication mechanisms, access control implementation, injection prevention, security testing, or any specific platform hardening measures. The privacy policy's security section contains only the generic disclaimer 'we are striving to use commercially acceptable means of protecting it.'

No information found about hallucination mitigation, approval workflows, output verification, undo/rollback capabilities, or transparency about AI uncertainty. The site does not address output reliability or trust exploitation risks at all.