# Tensorlake

> Firecracker microVMs that keep their memory across a pause, sold as prepaid credits or a $250 Pro plan.

Website: https://www.tensorlake.ai  
Guide page: https://botperch.com/providers/tensorlake/  
Checked: 2026-10-29

**Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $250.00 a month here, the 11th cheapest of the 11 providers that run it as described. The AI model adds about $14.70 a month on top (GLM 5.3, 30 requests a day at 40k tokens each, median zero-retention price; from $6.84 at the cheapest host). Fits well: An agent that must pause mid-task: suspend and memory snapshots both keep the process tree, and resume takes about a second.

Tensorlake sells isolated Linux microVMs for agents, one per task or one per session, that boot in a few hundred milliseconds and can be frozen with their memory, processes and files intact and resumed later under the same name.
Each machine is a Firecracker microVM with its own kernel and a root disk you size from 10 to 100 GB. You drive it from a Python or TypeScript SDK, a tl CLI, plain HTTP, SSH or a WebSocket terminal, and you can mount a durable versioned volume or a Tensorlake-hosted Git repository into it.
The same company also sells durable workflow orchestration, a versioned filesystem, hosted Git and GitHub Actions runners, so a team can put an agent's code, its working files and its long-running jobs in one place. The sandbox is the part this page compares.

**Who it is for:** Engineering teams running agents that must survive a pause — long coding sessions, evaluation sweeps, RL rollouts — who are comfortable installing a CLI or SDK and want a real VM rather than a container.

**Isolation:** Firecracker microVM with its own kernel, root and /dev/kvm, so nested QEMU/KVM virtual machines run inside. Docker needs the tensorlake/ubuntu-systemd image plus an install step. GPU sandboxes are gVisor instead of a VM.

**Sizes and regions:** Per-sandbox ceilings by plan: Free 1 vCPU / 1 GB / 10 GB; Usage Credits 4 vCPU / 16 GB / 100 GB; Pro 16 vCPU / 64 GB / 100 GB; Enterprise custom. RAM must be 1–8 GB per vCPU. Disk is 10–100 GB, growth-only.

## How it charges

- model: Prepaid Usage Credits in $5, $10 or $20 packs (1 CU = $0.01), or Pro at $250 a billing cycle including 25,000 CU.
- meter: Per second: $0.07 per active CPU core-hour, $0.015 per GB-hour of RAM, $0.0002 per GB-hour of root disk on credits; $0.042, $0.009 and $0.0001 on Pro. Egress is free.
- stopped: A suspended sandbox bills no CPU, RAM or disk; its preserved state bills as snapshot storage at $0.07 per GB-month.
- planFee: $250 a billing cycle on Pro, which includes 25,000 CU ($250 of usage). Usage Credits have no fee: you buy packs and spend them down.
- minimum: Nothing on Free, which needs no card. Usage Credits start at a $5 pack; Pro is $250 a month.

Per second on active CPU, allocated RAM and disk, drawn from prepaid credits or a $250 Pro plan; a suspended sandbox bills snapshot storage only.
- Rates are the Usage Credits rates. Pro's rates are lower — $0.042 per active core-hour, $0.009 per GB-hour of RAM (both 40% less) and $0.0001 per GB-hour of disk (50% less) — and its $250 fee includes 25,000 CU. The calculator prices every plan at the higher Usage Credits rates, so a Pro bill above $250 of monthly usage is overstated.
- Tensorlake's own pages word Pro differently: the pricing page says the fee includes 25,000 CU ($250 of usage); the billing docs and FAQ say "$250 per month plus metered usage". This guide reads them together as $250 that includes $250 of usage, with usage beyond it billed. Get it in writing before relying on it.
- CPU bills only while it executes, so the engine applies the workload's busy share. When Tensorlake cannot sample active CPU it falls back to allocated vCPU time, which costs more.
- Snapshot storage is $0.07 per GB-month while a sandbox is suspended, modelled here as a per-GB-hour stopped rate (0.07 ÷ 730) on the sandbox's disk size. Tensorlake says only unique bytes are billed, so the real figure can be lower.
- Billing is by the second in whole compute units, pooled per organization. Egress is free.
- Memory must be 1–8 GB per vCPU, so a 1 vCPU sandbox cannot exceed 8 GB of RAM.

## Monthly cost for each preset workload

- A personal agent that stays on (Hermes, OpenClaw): $250.00
- A coding agent for one developer: $24.46
- A code interpreter inside your product: $28.60
- A browser agent for a small team: $331.00
- Self-hosted n8n for a small team: $250.00
- A Discord or Slack bot for one server: $250.00
- Claude Code for a team of five: $120.95
- A scraper that runs four times a day: $1.20
- Your own remote MCP server: $250.00
- A: 1,000 short tasks: $22.00
- B: one always-on box: $250.00
- C: three hours a day: $8.25

## Fits well

- An agent that must pause mid-task: suspend and memory snapshots both keep the process tree, and resume takes about a second.
- Evaluation sweeps and RL rollouts: pre-warmed pools, non-blocking creates and copy-by-N fan one warmed sandbox out to a fleet.
- A coding agent that needs a real machine: /dev/kvm, Docker on the systemd image, SSH with port forwarding and VS Code Remote-SSH.
- Work that must outlive the sandbox: versioned volumes mounted as ordinary directories, or a Tensorlake-hosted Git repository.

## Fits badly

- Someone who will not use a terminal: there is no documented console button for a first sandbox, and every guide starts with a CLI install.
- Keeping credentials away from the agent: keys arrive as environment variables the agent's own processes can read.
- An always-on personal assistant on a small budget: Pro is $250 a month, and cheaper plans end a session after 24 hours.
- A custom hostname on the hosted product: only a self-hosted BYOC ingress lets you own the domain.

## Features

- **Isolation** (yes): Firecracker; /dev/kvm. A Firecracker microVM with its own kernel, root and /dev/kvm, so KVM-based hypervisors run inside and snapshots still work. Docker needs tensorlake/ubuntu-systemd plus an install step; the default image has no Docker. GPU sandboxes are gVisor instead, without live resize or volume mounts. [source](https://docs.tensorlake.ai/sandboxes/introduction) [docs](https://docs.tensorlake.ai/sandboxes/introduction)
- **Sizes and regions** (partly): 16 vCPU / 64 GiB; no region picker. Ceilings by plan: Free 1 vCPU / 1 GB / 10 GB, Usage Credits 4 / 16 / 100, Pro 16 / 64 / 100, Enterprise custom. Memory is 1–8 GB per vCPU and disk is 10–100 GB, growth-only. No region selector is published: the docs claim EU data residency, and BYOC puts sandboxes in your own AWS region. [source](https://www.tensorlake.ai/pricing) [docs](https://docs.tensorlake.ai/platform/billing)
- **Lifecycle** (yes): RAM + processes; ~1 s resume. Named sandboxes suspend on idle or on request and resume under the same ID with the process tree alive. Ephemeral sandboxes cannot suspend and are deleted at their timeout. Terminated sandboxes stay restartable for 48 hours, restoring from the latest snapshot when one exists. [source](https://docs.tensorlake.ai/sandboxes/quickstart) [docs](https://docs.tensorlake.ai/sandboxes/lifecycle)
- **Snapshots and forks** (yes): Memory or disk; copy ×N. Two snapshot types: filesystem restores with a cold boot, memory captures filesystem, memory and running processes and restores warm. Snapshots outlive the source sandbox and are deduplicated. copy boots one or many sandboxes from a running or suspended source, inheriting image, resources, network policy and exposed ports. [source](https://docs.tensorlake.ai/sandboxes/snapshots) [docs](https://docs.tensorlake.ai/sandboxes/snapshots)
- **Storage** (yes): 10–100 GB root; 8 volumes. Root disk 10–100 GB, ephemeral and growth-only. Cloud Volumes mount as ordinary POSIX directories, are durable and versioned with snapshots and time travel, and up to 8 can be mounted per sandbox, read-only, prefetched or pinned to a snapshot. Hosted Git repositories mount without a clone. [source](https://docs.tensorlake.ai/sandboxes/mount-filesystems) [docs](https://docs.tensorlake.ai/sandboxes/mount-filesystems)
- **Idle and waking** (yes): 10 min idle; 2 h to unlimited. timeout_secs is an idle threshold measured on proxy traffic — SSH, a PTY WebSocket, an exposed port, an SDK call — not a wall-clock lifetime. Default 600 s; maximum 2 h on Free, 24 h with Usage Credits, unlimited on Pro. Setting 0 requests the plan maximum. [source](https://docs.tensorlake.ai/sandboxes/lifecycle) [docs](https://docs.tensorlake.ai/sandboxes/lifecycle#timeout)
- **Reaching it** (yes): HTTPS per port; auth on by default. The proxy carries HTTP, WebSocket and gRPC, and preserves path and query. Auth is the default: requests need a project API key, or a signed-in session cookie from a browser. allow_unauthenticated_access makes exposed user ports public, but the management API on port 9501 always requires auth. [source](https://docs.tensorlake.ai/sandboxes/networking) [docs](https://docs.tensorlake.ai/sandboxes/networking)
- **Custom domains** (partly): BYOC ingress only. No custom-domain setting exists on Tensorlake Cloud: sandboxes live under sandbox.tensorlake.ai. In the BYOC mode where you run the ingress, you supply the NLB, an ACM certificate and a public DNS zone, and each sandbox gets a subdomain of your base domain. [source](https://docs.tensorlake.ai/platform/self-hosted-compute/aws) [docs](https://docs.tensorlake.ai/platform/self-hosted-compute/aws)
- **Outbound network** (yes): Allow/deny lists; free egress. allow_out takes domains, leading-wildcard domains, IPv4 addresses and CIDRs; deny_out wins on a conflict. The policy can be swapped on a running sandbox as one atomic change that closes existing connections, and a hostname that will not resolve rejects the update. allow_internet_access=false with an empty allowlist blocks DNS too. Egress is free. [source](https://docs.tensorlake.ai/sandboxes/networking) [docs](https://docs.tensorlake.ai/sandboxes/networking)
- **Keys and secrets** (partly): Env vars only. Environment variables are scoped to one command or one PTY session and merged into that process's environment. No secrets manager, placeholder substitution or egress-proxy injection is documented for sandboxes, so a key the agent needs is a key the agent can print. The orchestration product has its own Secrets page, which does not cover sandboxes. [source](https://docs.tensorlake.ai/sandboxes/environment-variables) [docs](https://docs.tensorlake.ai/sandboxes/environment-variables)
- **Ways to drive it** (partly): SDK, CLI, SSH; no MCP. Python and TypeScript SDKs, an async Python client, a tl CLI, REST, standard SSH with scp/rsync/port forwarding, a WebSocket PTY API, local TCP tunnels and an SDK desktop client. No control-plane MCP server is published; the console covers keys, spend, sandbox lists and process logs. [source](https://docs.tensorlake.ai/sandboxes/quickstart) [docs](https://docs.tensorlake.ai/sandboxes/quickstart)
- **Built-in agents** (partly): None; five integrations. Nothing is preinstalled: the images are Ubuntu, Debian and a VNC desktop. The routes are a tensorlake-opencode plugin that intercepts bash, read, write and edit, self-hosted environments for Claude Managed Agents and Cursor Cloud Agents, Devin Outposts, Crabbox for test suites, and a page on preloading skill files into images. [source](https://docs.tensorlake.ai/sandboxes/opencode) [docs](https://docs.tensorlake.ai/sandboxes/opencode)
- **Teams and accounts** (partly): Roles + SSO; no spend cap. Org admin and member roles, project admin and member roles, and API keys limited to project-member permissions. SSO over OIDC or SAML is available to org admins but has to be enabled for the organisation. No spend cap, budget alert or audit-log product is published; prepaid credits are the stop, and Pro adds a 1,000-sandbox concurrency ceiling. [source](https://docs.tensorlake.ai/platform/billing) [docs](https://docs.tensorlake.ai/platform/access-control)
- **Billing models** (yes): Active CPU; $250 Pro. Prepaid Usage Credits in $5–$20 packs (1 CU = $0.01) or Pro at $250 including 25,000 CU. CPU bills only while it executes, falling back to allocated vCPU time when sampling fails; RAM and disk bill on allocation while running; a suspended sandbox bills snapshot storage at $0.07 per GB-month; egress is free. [source](https://www.tensorlake.ai/pricing) [docs](https://docs.tensorlake.ai/platform/billing)
- **Trials and free tiers** (yes): Free forever, 1 sandbox. Free is $0 forever with no credit card: 1 concurrent sandbox, 1 vCPU / 1 GB / 10 GB, 2-hour sessions, unmetered sessions and SOC 2. Usage Credits begin with a $5 pack you choose; unused credits are kept rather than refunded and come back if you return to the plan. [source](https://www.tensorlake.ai/pricing) [docs](https://www.tensorlake.ai/pricing)
- **The company** (partly): Tensorlake, Inc.; 99.9% SLA. Tensorlake, Inc., San Francisco, founded 2023, 11–50 people, $8M seed from Artisanal Ventures, Plug and Play and Hawk Hill per third-party records with conflicting dates. SOC 2 Type 2 everywhere; HIPAA with a BAA on Pro and above but no HIPAA badge in the Trust Center. 99.9% control-plane availability, service credits capped at 50% of the month's fees and no cash refund, paid plans only. Public Datadog status page. California law, San Francisco courts. [source](https://www.tensorlake.ai/terms) [docs](https://docs.tensorlake.ai/platform/security)

## Capabilities

- Its own virtual machine: partly (VM, except GPU). The ordinary machines are real virtual machines, but the graphics-card machines you have to ask for are containers instead. [source](https://docs.tensorlake.ai/sandboxes/introduction)
- Root access: yes (sudo or --user root) [source](https://docs.tensorlake.ai/sandboxes/tensorlake-images)
- Docker inside: yes (needs ubuntu-systemd image) [source](https://docs.tensorlake.ai/sandboxes/tensorlake-images)
- Nested virtualisation: yes (/dev/kvm) [source](https://docs.tensorlake.ai/sandboxes/nested-virt)
- Your own image: yes (Dockerfile builds) [source](https://docs.tensorlake.ai/faqs/sandbox-images-faq)
- Any size you like: yes (any cores and memory) [source](https://docs.tensorlake.ai/platform/billing)
- Large machines: yes (16 cores / 64 GB). Only on the $250-a-month plan or above. [source](https://docs.tensorlake.ai/platform/billing)
- Resize while running: yes (cores, memory, disk live) [source](https://docs.tensorlake.ai/sandboxes/live-resize)
- GPUs: partly (by request). Graphics machines exist but you have to ask on Slack to be given access, and they cannot be resized or run virtual machines inside. [source](https://docs.tensorlake.ai/sandboxes/gpu)
- Choose the region: yes (US or EU) [source](https://docs.tensorlake.ai/platform/eu-data-residency)
- Runs in the EU: yes (EU endpoint) [source](https://docs.tensorlake.ai/platform/eu-data-residency)
- Pause keeps memory: yes. Only named sandboxes can be suspended; an unnamed one runs until it ends. [source](https://docs.tensorlake.ai/sandboxes/lifecycle.md)
- Pre-started pools: yes [source](https://docs.tensorlake.ai/sandboxes/pools.md)
- Starts in under a second: yes (Hundreds of ms) [source](https://docs.tensorlake.ai/sandboxes/introduction.md)
- Snapshots of files: yes [source](https://docs.tensorlake.ai/sandboxes/snapshots.md)
- Snapshots with memory: yes [source](https://docs.tensorlake.ai/sandboxes/snapshots.md)
- Copy a running machine: yes [source](https://docs.tensorlake.ai/sandboxes/snapshots.md)
- Pick an older snapshot: yes [source](https://docs.tensorlake.ai/sandboxes/snapshots.md)
- Reusable templates: yes [source](https://docs.tensorlake.ai/sandboxes/snapshots.md)
- Automatic backups: partly. Only the storage you mount is saved automatically; a machine's own disk has no copy. [source](https://docs.tensorlake.ai/filesystems/core-concepts.md)
- Files survive a stop: partly (48 h after terminate). A terminated machine can be brought back for 48 hours; after that its files are gone. [source](https://docs.tensorlake.ai/sandboxes/lifecycle.md)
- Separate volumes: yes [source](https://docs.tensorlake.ai/sandboxes/mount-filesystems.md)
- One volume, several machines: yes. Same-path writes are last-writer-wins, so two machines editing one file can clash. [source](https://docs.tensorlake.ai/filesystems/concurrent-writes.md)
- Mount outside storage: no [source](https://docs.tensorlake.ai/sandboxes/mount-filesystems.md)
- Large disk: yes (100 GB root) [source](https://docs.tensorlake.ai/platform/billing.md)
- Can stay on indefinitely: partly (2 h free, 24 h credits). A free sandbox stops after 2 idle hours and a credit-plan sandbox after 24; only Pro and Enterprise are unlimited. [source](https://docs.tensorlake.ai/sandboxes/lifecycle.md)
- Choose the idle timeout: yes [source](https://docs.tensorlake.ai/sandboxes/lifecycle.md)
- Wakes on a request: yes [source](https://docs.tensorlake.ai/sandboxes/lifecycle.md)
- Scheduled runs: no [source](https://docs.tensorlake.ai/applications/concepts.md)
- Public link to a port: yes (Per-port switch) [source](https://docs.tensorlake.ai/sandboxes/networking.md)
- Private link: yes (Project key) [source](https://docs.tensorlake.ai/sandboxes/networking.md)
- Real SSH: yes (Standard ssh) [source](https://docs.tensorlake.ai/sandboxes/pty-sessions.md)
- Terminal in the browser: not-published [source](https://docs.tensorlake.ai/sandboxes/process-logs.md)
- Tunnel to your computer: yes (Local tunnel) [source](https://docs.tensorlake.ai/sandboxes/tunnels.md)
- Non-web ports: partly (Through a tunnel). The public address carries web traffic and SSH only; a database needs a tunnel from your own computer. [source](https://docs.tensorlake.ai/sandboxes/tunnels.md)
- Your own domain: not-published [source](https://docs.tensorlake.ai/sandboxes/networking.md)
- Automatic HTTPS: not-published [source](https://docs.tensorlake.ai/sandboxes/networking.md)
- Outbound data included: not-published [source](https://docs.tensorlake.ai/platform/billing.md)
- Allow only some sites: yes (Domains or addresses) [source](https://docs.tensorlake.ai/sandboxes/networking.md)
- Turn the internet off: yes (--no-internet) [source](https://docs.tensorlake.ai/sandboxes/networking.md)
- Fixed outgoing IP: not-published [source](https://docs.tensorlake.ai/sandboxes/networking.md)
- Stored secrets: no. There is no saved secret: you pass the value with each command or session. [source](https://docs.tensorlake.ai/sandboxes/environment-variables.md)
- Secrets the agent cannot read: no. There is no service that adds keys to requests; the machine holds whatever you pass it. [source](https://docs.tensorlake.ai/sandboxes/environment-variables.md)
- Limited API keys: yes (Project-scoped) [source](https://docs.tensorlake.ai/platform/authentication.md)
- Create from the website: no [source](https://docs.tensorlake.ai/faqs/sandboxes-faq.md)
- Command-line tool: yes [source](https://docs.tensorlake.ai/sandboxes/quickstart.md)
- Python SDK: yes [source](https://docs.tensorlake.ai/sandboxes/quickstart.md)
- TypeScript SDK: yes [source](https://docs.tensorlake.ai/sandboxes/quickstart.md)
- Documented HTTP API: yes [source](https://docs.tensorlake.ai/llms.txt)
- MCP server: no [source](https://docs.tensorlake.ai/sandboxes/chrome-cdp.md)
- Interactive terminal over the API: yes [source](https://docs.tensorlake.ai/sandboxes/pty-sessions.md)
- Files over the API: yes [source](https://docs.tensorlake.ai/sandboxes/file-operations.md)
- Coding agents preinstalled: no. The managed images ship an OS, a desktop and tooling; no coding agent is installed. [source](https://docs.tensorlake.ai/sandboxes/tensorlake-images.md)
- Send it a prompt: no. Tensorlake exposes a sandbox as a tool for your own agent; it does not run an agent from a prompt. [source](https://docs.tensorlake.ai/sandboxes/tool-calls.md)
- One-click Hermes: no. No Hermes template or guide is published. [source](https://docs.tensorlake.ai/sandboxes/tensorlake-images.md)
- One-click OpenClaw: no. No OpenClaw template or guide is published. [source](https://docs.tensorlake.ai/sandboxes/tensorlake-images.md)
- Browser built in: yes [source](https://docs.tensorlake.ai/sandboxes/chrome-cdp.md)
- Desktop for computer use: yes [source](https://docs.tensorlake.ai/sandboxes/computer-use.md)
- Runs other platforms' agents: yes [source](https://docs.tensorlake.ai/sandboxes/cursor-cloud-agents.md)
- Team workspace: yes [source](https://docs.tensorlake.ai/platform/access-control.md)
- Roles and permissions: partly (Admin and member only). Every plan gets two fixed roles, admin and member, at organization and project level; fuller role-based access is listed under the Enterprise plan. [source](https://docs.tensorlake.ai/platform/access-control)
- Single sign-on: partly. SSO is listed on the Enterprise plan, and the docs say access must be enabled for your organisation. [source](https://docs.tensorlake.ai/platform/sso.md)
- Hard spending cap: partly. Prepaid credit packs cannot be overspent, but the Pro plan bills overage beyond its included usage. [source](https://www.tensorlake.ai/pricing)
- Usage alerts: not-published [source](https://docs.tensorlake.ai/platform/billing.md)
- Audit log: partly. Audit logs are not self-serve: you ask support for them. [source](https://docs.tensorlake.ai/platform/security.md)
- Billed per second: yes (per second) [source](https://docs.tensorlake.ai/platform/billing)
- CPU billed only while working: yes (active CPU only) [source](https://docs.tensorlake.ai/platform/billing)
- Paused costs only storage: yes (storage only) [source](https://docs.tensorlake.ai/sandboxes/lifecycle)
- No monthly fee: yes (prepaid credit) [source](https://docs.tensorlake.ai/platform/billing)
- Flat monthly price: no (metered parts). The bill is processor time plus memory plus disk plus storage. [source](https://docs.tensorlake.ai/platform/billing)
- Ongoing free tier: yes (1 machine, 1 core / 1 GB) [source](https://docs.tensorlake.ai/platform/billing)
- Free starting credit: no (none). There is no starting credit; the free plan is a small machine and credit is bought in packs. [source](https://docs.tensorlake.ai/platform/billing)
- Try without a card: yes (free plan, no card) [source](https://docs.tensorlake.ai/platform/billing)
- Public status page: yes [source](https://status.tensorlake.ai)
- Uptime promise (SLA): no. The only published SLA is a 24-hour response to a P1 support ticket, not an uptime promise. [source](https://www.tensorlake.ai/pricing)
- SOC 2 report: yes (Type 2) [source](https://docs.tensorlake.ai/platform/security.md)
- Data processing agreement: yes [source](https://www.tensorlake.ai/dpa)
- Open source or self-hostable: partly (BYOC, Enterprise). Self-hosting is offered only on the Enterprise plan and only in your own AWS account; the software is not open source. [source](https://docs.tensorlake.ai/platform/self-hosted-compute/aws.md)

## Usability

- Dashboard: A cloud console at cloud.tensorlake.ai: projects, API keys, a usage tab with cost tiles and vCPU-hours, invoices and credit packs, and a Sandboxes list with a per-sandbox Logs tab you can filter and search.
- Without code: No. The first step is pip install tensorlake, npm i @tensorlakeai/tensorlake or the curl | sh CLI installer, then a create call. The console covers keys, spend and logs, not making a machine.
- Signup: Email or a social login at cloud.tensorlake.ai; the free tier needs no card. API keys are per project, start with tl_apiKey_, and carry project-member permissions only.
- Docs: 108 pages in the llms.txt index, each available as Markdown plus an llms-full.txt bundle, and unusually deep on edge cases: pending reasons, resize generations, mount fail-closed rules, PTY frame bytes. Support is Slack and email, with a founder replying on smaller plans.
- Trips people up: The stock images run as tl-user, who cannot write to /workspace; guides that assume /workspace fail until you use /home/tl-user.
- Trips people up: timeout_secs is an idle timer on proxy traffic, not a lifetime: a sandbox with no proxied traffic suspends even mid-task.
- Trips people up: Only named sandboxes can suspend; an ephemeral sandbox is deleted when its timeout fires.
- Trips people up: pip install needs --break-system-packages on the stock images, which are PEP 668 managed.
- Trips people up: Pro is the only plan without a session cap, so anything that must stay up costs $250 a month.
- Trips people up: A custom domain exists only in the self-hosted BYOC ingress mode, not on Tensorlake Cloud.

## Company

- Legal entity: Tensorlake, Inc. (written TensorLake in the Terms). Governed by California law, with exclusive venue in San Francisco. [source](https://www.tensorlake.ai/terms)
- History and base: Founded 2023, headquartered in San Francisco, California. Third-party records disagree on the year (one says 2022). [source](https://indexed.vc/companies/tensorlake)
- Funding: $8M seed, investors Artisanal Ventures, Plug and Play and Hawk Hill Ventures. Third-party records date the round 2024 or 2025; Tensorlake publishes no announcement. [source](https://indexed.vc/companies/tensorlake)
- Headcount: Small: one third-party record gives a band of 11–50 employees; Tensorlake publishes no team page that would confirm a number. [source](https://indexed.vc/companies/tensorlake)
- Certification: SOC 2 Type 2 on every tier, report gated behind the Trust Center. HIPAA is claimed with a BAA from Pro up, but the Trust Center shows only a SOC 2 badge. [source](https://docs.tensorlake.ai/platform/security)
- Data residency: EU data residency and zero data retention are claimed; there is no region selector in the sandbox API, and BYOC defaults to us-east-1. [source](https://docs.tensorlake.ai/sandboxes/introduction)
- SLA: 99.9% monthly availability for the control plane, with service credits capped at 50% of the month's fees and no cash refund. Paid plans only. [source](https://www.tensorlake.ai/terms)
- Support: Slack community and email on every tier, 24×7 Slack and email on Pro with a 24-hour P1, and a 1-hour P1 plus a resident SA on Enterprise. [source](https://www.tensorlake.ai/pricing)
- Status page: A public Datadog status page covers Applications and Sandboxes; sandboxes showed 99.89% uptime over the 90 days to 29 October 2026. [source](https://status.tensorlake.ai/)
- Subprocessors: Google Cloud and AWS for infrastructure, Cloudflare and Datadog for monitoring, listed in the Trust Center as Annex III of the DPA. [source](https://trust.tensorlake.ai/)

## Caveats

- **Whether Pro's $250 includes $250 of usage** (contradiction): The pricing page says the fee includes 25,000 CU worth $250. The billing docs and the pricing FAQ both describe Pro as '$250 / month + usage' and say Pro deducts usage, with no allowance mentioned.
- **Resources are called fixed at create on one page and resizable on another** (contradiction): The lifecycle page says CPU, memory and disk are fixed when the sandbox is created and cannot be changed afterwards. The live-resize page documents changing all three on a running sandbox, and the SDK update call does it.
- **The prepaid tier has two names** (open): The docs and dashboard call it Usage Credits; the Terms call the same plan On-Demand. Nothing says whether they are the same product.
- **Free credits are promised in one place and absent in another** (open): The Harbor guide says new accounts include free credits. The pricing page describes a $0 free tier with no card and prepaid packs starting at $5, with no signup credit mentioned.
- **EU data residency without a region selector** (open): The introduction claims EU data residency, but no sandbox API parameter, console control or region list is published, and the BYOC example defaults to us-east-1. Which plan gets EU placement is unclear.
- **Snapshot storage is billed per GB-month of 'unique bytes'** (open): Rates say $0.07 per GB-month; the snapshot page says users are billed only for unique bytes, so the stored size of a suspended sandbox is not simply its disk size. The calculator models it as the disk size and will overstate.
- **A malicious npm release shipped in October 2026** (open): The Trust Center records a malicious tensorlake@0.5.144 published to npm on 8 October 2026 with a GitHub advisory. Pin a version and check the advisory before installing the JavaScript SDK.
- **HIPAA is claimed but not badged** (open): Pricing says HIPAA with a BAA on Pro and above, and the docs call the platform HIPAA compliant; the Trust Center lists a SOC 2 badge and no HIPAA badge, and the Terms forbid storing protected health information without a written agreement.

## Sources

- [Docs](https://docs.tensorlake.ai/sandboxes/introduction)
- [Lifecycle](https://docs.tensorlake.ai/sandboxes/lifecycle)
- [Snapshots and clone](https://docs.tensorlake.ai/sandboxes/snapshots)
- [Networking](https://docs.tensorlake.ai/sandboxes/networking)
- [Pricing and billing](https://docs.tensorlake.ai/platform/billing)
- [Pricing](https://www.tensorlake.ai/pricing)
- [Terms](https://www.tensorlake.ai/terms)
- [Trust Center](https://trust.tensorlake.ai/)
- [Status](https://status.tensorlake.ai/)