Daytona's $24M Compliance Bet: What a HIPAA/SOC 2 AI Sandbox Really Costs to Build Yourself

On February 5, 2026, Daytona — the company building "composable computers" for AI agents — closed a $24M Series A led by FirstMark Capital, with Datadog and Figma Ventures joining as strategic investors and Matt Turck taking a board seat. The pitch that got that check written wasn't cold-start latency or GPU throughput, the metrics E2B, Modal, and Vercel Sandbox usually get compared on. It was compliance: HIPAA and SOC 2 posture, plus sandboxes that run on compute the customer controls, aimed at healthcare and financial-services teams who can't let an AI agent execute generated code on somebody else's shared infrastructure.

That's a specific, checkable claim, and it's worth taking apart into its two halves — because the two halves have completely different price tags. One is compute topology: whose machine does the sandbox actually run on. The other is a paper trail: audited controls, signed agreements, an ongoing maintenance program. A funded vendor is now charging enterprises for both. This piece prices out what it would cost a self-hosted platform to build each half itself — and which half it might already own for free just by being self-hosted.

What Daytona is actually selling​

Daytona's core product is a sandbox: a programmatic, disposable machine — CPU, memory, storage, GPU, networking, OS — that an AI agent can spin up in roughly 90ms, fork into parallel branches to explore multiple decision paths, and snapshot mid-execution so state survives a crash. Post-raise, the company reported reaching a $1M forward revenue run rate in under three months and doubling it six weeks later, so the demand for some form of this is real.

The compliance story layered on top deserves a more careful read than "Daytona is HIPAA certified," which is the shorthand a lot of the funding coverage reached for. HIPAA doesn't have a certifying body — there's no HIPAA cert to hold, only a signed Business Associate Agreement (BAA) plus documented controls a covered entity is willing to accept. What Daytona actually has, per its own security documentation, is a HIPAA BAA available to customers, GDPR coverage, and SOC 2 Type I completed with Type II in progress — a Type I report attests controls exist at a point in time; Type II attests they operated correctly over a period (typically 6–12 months of observation). That's a meaningfully earlier stage than "certified," and it matters for this piece's argument: Daytona is still mid-build on the exact paper trail it's charging a premium for.

The compute half of the pitch is architecturally more interesting. Daytona's default is its own hosted cloud, but it also offers Bring Your Own Compute (BYOC) and Customer Managed Compute: the customer supplies "runner" machines, and Daytona's control plane schedules sandboxes onto them. That's a genuine and useful deployment option for a regulated tenant who needs sandbox execution to happen inside their own VPC or on-prem estate. But it's worth being precise about what doesn't move: even in BYOC mode, Daytona's control plane — the system deciding what runs where, holding API credentials, orchestrating snapshots — stays Daytona's. The customer owns the compute; the vendor still owns the orchestration layer sitting in front of it. "Your compute, our isolation layer" is an accurate description of the product, not a knock on it — but it's not the same claim as "nothing about this sandbox touches infrastructure outside your boundary," which is what a fully self-hosted platform can actually say.

What building the compliance half yourself actually costs​

Here's the number a team evaluating "pay Daytona for compliance" versus "build it ourselves" needs. Pricing varies with scope, auditor, and how many trust-service criteria you cover, but the 2026 market has settled into a fairly consistent band for a first SOC 2 Type II report:

That's the audit-and-attestation line. HIPAA compliance for the sandbox execution layer specifically adds a technical checklist that a self-hosted platform has to implement and document, not just implement:

• Network isolation — sandboxes run inside a private VPC/subnet with restricted ingress and controlled, allow-listed egress; TLS terminated at a hardened reverse proxy.
• Identity and access — SSO through an enterprise IdP, RBAC scoped per tenant, MFA enforced on every human path into the control plane.
• Data protection — encrypted database and object storage for any sandbox state or logs that could contain PHI, with rotated keys and a documented retention/deletion policy (agent execution logs are exactly the kind of thing that silently retains sensitive data if nobody sets a pruning schedule).
• Monitoring — logs forwarded to a SIEM with write-once (WORM) retention, correlated against infrastructure events for incident response.
• Assurance cadence — scheduled vulnerability scans and penetration tests, with findings and remediation timelines documented, not just fixed.
• The BAA itself — a signed contract naming permitted uses/disclosures of PHI, breach-notification obligations and an SLA for reporting one, subcontractor flow-down terms, and termination/data-return rights.

None of that is exotic engineering. All of it is real, budgetable work with a real audit bill attached, and a regulated tenant's security team will ask for the SOC 2 Type II report (not Type I) and the signed BAA by name before they'll sign a contract. That's the shortcut Daytona is selling: a team that would rather pay a vendor $25K–$80K-plus-a-cut-of-revenue than run that six-to-twelve-month project themselves.

The half a self-hosted platform already has​

Here's where the ownership story gets interesting for a platform like bex, or any Cluster API-managed fleet running on owned Hetzner hardware. "Customer-managed compute" isn't a premium tier to opt into when there's no "our cloud" in the first place — every tenant's workload already runs on machines the operator owns outright. There's no BYOC toggle to flip, because the alternative (someone else's shared multi-tenant cloud) was never the default. That single structural fact is the entire compute half of Daytona's pitch, delivered by the platform's basic shape rather than sold as an add-on.

The isolation layer follows the same logic. The Kubernetes ecosystem has converged on the same two backends Daytona itself uses under the hood — gVisor (a user-space kernel that intercepts syscalls, giving strong isolation without full-VM overhead) and Kata Containers (a real VM per pod, at the cost of higher startup latency) — now standardized behind a RuntimeClass selector via the SIG's Agent Sandbox CRD. A self-hosted PaaS running tenant AI-agent sandboxes on its own Cluster API fleet is pointed at exactly the same isolation primitives, on infrastructure it already operates, with no vendor's control plane in the loop deciding placement. Where Daytona's BYOC still means their orchestrator schedules onto your machines, a genuinely self-hosted platform's own control plane is the only thing that ever sees the sandbox — nothing crosses an operator boundary that isn't the tenant's own.

That's not a small thing to already have. It's the harder half of Daytona's pitch to fake — you can't buy your way into "the vendor's control plane was never in the critical path" after the fact; it has to be true of the architecture from the start.

The half that still isn't free​

None of that architecture writes a SOC 2 report. This is the gap worth being honest about: owning the hardware and running your own isolation stack proves nothing to an auditor by itself. A SOC 2 Type II report is an independent auditor's attestation that specific controls operated correctly over an observation window — it doesn't exist until someone runs that six-to-twelve-month process and pays for the engagement. A HIPAA BAA is a bilateral legal contract, not a badge a good architecture earns automatically. "We own our own servers" is a genuinely strong answer to "where does our code run," and a genuinely useless answer to "show me your penetration test report from the last twelve months."

So a self-hosted platform selling into regulated tenants faces the same $25K–$80K first-year, 6–12-month project Daytona already ran for its own customers — the difference is who's paying for it and who it's for. A platform vendor selling the sandbox as a product needs its own SOC 2 report to hand a tenant's security team. A self-hosted platform whose tenant runs the boxes themselves can push more of that obligation onto the tenant's own compliance program, but the operator still needs its own controls — access logging, encrypted secrets, patch cadence, incident response — documented and auditable the moment a regulated tenant asks.

What this actually settles​

Daytona's raise is a useful data point precisely because it's a funded vendor putting a price on the exact pitch a self-hosted, owned-hardware platform makes structurally: your code doesn't run on infrastructure you don't control. The compute-ownership half of that pitch, a self-hosted platform gets for free, by design, no BYOC toggle required. The compliance-paperwork half — the audit, the BAA, the pentest cadence — is real work with a real six-figure-adjacent price tag that architecture alone doesn't discharge, no matter who owns the rack.

The honest framing for a team building or evaluating a self-hosted AI-agent sandbox isn't "we're already compliant because we own the hardware." It's "we've already solved the harder, unbuyable half of what a funded vendor is charging for — and we still owe the audit."

Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Star the repo on GitHub or deploy your first app today.

Sources:

• Daytona Raises $24M Series A to Give Every Agent a Computer
• Daytona: $24 Million Series A Raised For Building Composable Computers For AI Agents
• Daytona — Secure Infrastructure for Running AI-Generated Code
• Bring Your Own Compute (BYOC) | Daytona Docs
• Customer Managed Compute | Daytona Docs
• Daytona vs E2B vs Modal vs Vercel Sandbox: A 2026 Comparison
• How Much Does SOC 2 Compliance Audit Cost in 2026?
• SOC 2 Audit Cost 2026: $10K–$430K (Data From 171 Firms)
• HIPAA IT Compliance Checklist & HIPAA IT Infrastructure Guide 2026
• Running Agents on Kubernetes with Agent Sandbox | Kubernetes Blog
• Agent Sandbox — Kata Containers