Sandcastle

Your team’s apps, behind your company login.

Sandcastle is the internal cloud for apps built with coding agents. Every app gets a stable URL, a database, secrets and an audit trail.

An illustrated beach with three sandcastles. Each is labelled with an example internal app.
expensesexpenses.acme.sandcastle.siteLive, Finance group
ops-dashops-dash.acme.sandcastle.siteLive, everyone at Acme
oncall-botoncall-bot.acme.sandcastle.siteWaiting on host approval

What every app gets

Declared in one file, sandcastle.yaml, and validated before anything is pushed.

Company login

Google Workspace, GitHub or OIDC, with roles per route.

Postgres and files

Per app, with daily backups checked for integrity.

LLM gateway

Daily request and token caps, with no key in the app.

Scheduled jobs

Cron in the manifest, with every outcome visible.

Secrets

Stored encrypted. Only names and digests come back.

Approved egress

Owners and admins approve each outbound host.

Deploy from your agent

Works with Claude Code, Codex, Cursor or any agent that runs a CLI. It shows you a plan, you approve it, and failed releases never go live.

sandcastle login
# once, with your company sign-in

sandcastle init
# writes sandcastle.yaml, installs the skill

"deploy this to sandcastle"
# say it to your agent

Join the waitlist