OpenClawHosting.io

LiveBest for Teams

Multi-agent platform with enterprise team features and management dashboard

From

$29/mo

Platform fee only; server & AI costs separate. 20% annual discount.

Security

Good 32.4/100

Price Range

$29/mo – $399/mo

Free Tier

Integrations

8 platforms

Security Score: 32.4/100 — Good

OpenClawHosting.io is the same entity as DeployClaw (operated by Macrofix Software Private Limited). It is NOT affiliated with the open-source OpenClaw project. The openclawhosting.io domain presents more detailed security claims than deployclaw.com. Self-hosted architecture is the core security proposition. Named security lead (Jamieson O'Reilly/Dvuln) on the upstream project, AES-256 credential vault, Docker sandboxing, 2FA on dashboard. Several claims are marketing-level without evidence: 'regular security audits' (no reports), 'SOC 2 Type II (in progress).' Docs and status page don't resolve. Agent guardrails and misinformation controls unaddressed. Team of 4 with credible infra backgrounds (Render, Supabase, Notion, Fly.io).

10 risk categories scored 1-10 × evidence weight. Based on our methodology, grounded in OWASP Agentic Security, NIST CSF 2.0, and CIS Controls.

Can anyone else see my data?6/10

Self-hosted (BYOS) architecture is the primary mitigation: 'Conversations, files, and agent memory live exclusively on your hardware. No telemetry leaves the box unless you configure it.' Privacy policy: 'never read, store, or analyze your AI agent conversations' and 'never train AI models on your data.' Features page claims 'Encrypted storage for credentials and conversation history.' However, the platform maintains 'a secure management connection for applying updates and health checks.' No log sanitization or employee access audit trail details.

Can someone take over my agent?5/10

Features page claims 'Sandboxed execution: agent actions run in isolated containers' and 'Per-tool permission controls: approve what the agent can touch.' The upstream OpenClaw GitHub SECURITY.md references Docker sandboxing: 'docker run --read-only --cap-drop=ALL.' No mention of prompt injection defenses, memory integrity protection, or human-in-the-loop for goal changes on the hosting platform itself.

Are my keys and passwords safe?6/10

Features page describes 'AES-256 encrypted vault with automatic rotation. No plaintext credentials in config files.' GitHub SECURITY.md references 'detect-secrets' for CI/CD scanning. Features page claims 'Encrypted storage for credentials and conversation history.' No credential leak detection in outputs or documentation on credentials being excluded from AI model context.

Can my agent do things I didn't authorize?4/10

Features page mentions 'Per-tool permission controls: approve what the agent can touch.' GitHub README references DM access controls. No spending caps, rate limiting, resource consumption limits, kill switches, or behavioral monitoring documented.

Can I lose my data or get locked out?5/10

Self-hosted page: 'Portable Backups: Export your entire OpenClaw state as a single archive. Restore on a different provider in minutes.' Data export addressed. Terms allow 30-day data request after termination. Self-hosted FAQ: 'Your server and data remain yours' even if you stop paying. No tested backup verification, circuit breakers, or SLA. Status page doesn't resolve.

Will I get unexpected bills?6/10

Four tiers at $29/$49/$149/$399/mo clearly separated from infrastructure costs. 'Transparent rates with zero surprise charges.' Terms: '30 days notice' for price changes. Prorated billing. No hard spending caps on AI usage, no usage monitoring alerts.

Who's responsible when something goes wrong?4/10

Features page claims 'Immutable audit log of every agent action.' Privacy policy mentions 'Regular security audits and penetration testing' without evidence. 'SOC 2 Type II compliance (in progress)' — explicitly not achieved. Delaware governing law. GDPR rights outlined. No incident response process or breach notification timeline published.

What if a tool or dependency gets compromised?5/10

Built on open-source OpenClaw (MIT, 201k GitHub stars). SECURITY.md has detect-secrets in CI/CD, named security contact (Jamieson O'Reilly/Dvuln), CVE tracking. However, the hosting platform itself (deployclaw.com/openclawhosting.io) is not open-source. No published SBOM or MCP server vetting process.

Is the platform itself secure?5/10

Features page claims 'Dashboard secured with 2FA.' Registration shows Google OAuth. Features mention 'GDPR, SOC 2, and HIPAA-aligned configuration options' and 'Data residency: choose US, EU, or APAC.' GitHub SECURITY.md provides Docker hardening guidance. Docs site (docs.openclaw.dev) and status page both fail to resolve. No published security testing results.

Can I trust what my agent tells me?2/10

No information about mitigations for AI hallucinations, output manipulation monitoring, approval workflows, independent verification, undo/rollback, or AI uncertainty transparency.

V = VerifiedD = DocumentedC = ClaimedU = Unknown

Audit trail (all tiers)SSO/SAML (Business tier)Rolling security updates