ShipClaw
LiveBest Value BundleManaged hosting with included AI credits and 30-second deployment
Security Score: 11.6/100 — Basic
ShipClaw is an early-stage OpenClaw hosting provider focused on ease of deployment ('30 seconds, no Docker'). Professional-looking website with clear pricing and standard legal documents. Security documentation extremely thin — limited to marketing claims without technical specifics. No security page, no trust page, no status page, GitHub link 404, docs are a Fumadocs placeholder. Privacy policy has some specifics (encrypted credentials, named providers). Runs on Fly.io with Stripe payments. Overall very early stage with minimal security engineering evidence.
10 risk categories scored 1-10 × evidence weight. Based on our methodology, grounded in OWASP Agentic Security, NIST CSF 2.0, and CIS Controls.
Homepage claims '100% Isolated Instances' and FAQ states 'Each AI agent runs on isolated infrastructure. We don't access your conversations or data. All connections are encrypted.' Privacy policy mentions 'encryption, access controls, and monitoring.' No technical detail on isolation type (container? VM?), no AI training opt-out, no employee access controls or audit trails. Data retention is vague ('retained for a limited period').
No information on prompt injection defenses, sandboxing, human-in-the-loop, memory integrity, or container escape prevention. FAQ says agents 'can browse websites, fill forms, send emails, manage spreadsheets, write documents, execute code' — significant capabilities with no documented guardrails. Only 'isolated environment' addresses multi-tenancy, not hijacking.
Privacy policy states 'API keys, bot tokens, and access tokens required to run your instance. These are encrypted at rest when stored by our platform.' Two AI access modes: 'Platform Managed' (OpenRouter, no key needed) and 'Use Your Own Key.' No credential leak detection, rotation, lifecycle management, or documentation on whether credentials are excluded from AI context.
No guardrails documented: no least privilege, tool gating, resource limits, kill switches, or behavioral monitoring. '24/7 Active Monitoring' mentioned in context of uptime, not agent behavior. Fixed resource tiers (CPU/RAM/SSD) could indirectly limit consumption.
No backups, data export, or disaster recovery mentioned. ToS states 'We may change, suspend, or discontinue any part of ShipClaw at any time.' Claims '6 Global Regions' but no redundancy stated. No status page (404), no SLA. Hosted on Fly.io per privacy policy.
Pricing clear: Starter $49/mo, Pro $99/mo, Business $200/mo with specific resources and included AI credits ($10, $25, $50). FAQ: 'No contracts — cancel your subscription anytime.' No mention of overage charges when credits exhausted, no hard spending caps, no usage alerts. ToS reserves right to change features and pricing.
Privacy policy mentions collecting 'audit logs' and 'security events,' suggesting some logging exists. No incident response process, breach notification timeline, agent action audit trail details, or data jurisdiction info beyond 'multiple countries.' No security contact or vulnerability disclosure.
Privacy policy names providers: 'Stripe for payments; Fly.io for infrastructure; OpenRouter for platform-managed model access.' Good supply chain transparency but no dependency scanning, MCP vetting, SBOM, or build pipeline integrity. Docs page is a Fumadocs template placeholder. GitHub (github.com/shipclaw) returns 404.
Registration offers Google OAuth, GitHub OAuth, and email/password. HTTPS throughout. Privacy policy mentions 'encryption, access controls, and monitoring.' No MFA visible, no injection prevention docs, no SSRF protection, no independent security testing. Docs being a template placeholder suggests early development stage.
No information on AI output reliability mitigations: no approval workflows, verification, undo/rollback, or uncertainty transparency.
Key Features
- ✓30-second deployment
- ✓AI credits included (no BYOK needed)
- ✓Browser automation built-in
- ✓Real-time logs and monitoring
- ✓Auto-scaling
- ✓6 global regions
Integrations
Strengths
- +AI credits included (removes BYOK friction)
- +Fastest claimed deploy time (30s)
- +Browser automation built-in
- +Multiple global regions
Weaknesses
- −Telegram-only integration currently
- −Solo developer project
- −2GB RAM on starter plan insufficient for browser use
- −Generic security claims
Verdict
Best if you want AI credits included and don't want to bring your own API keys. Limited to Telegram for now.