SophosAICleaner security boundary
No Fly.io tokens, model keys, user files, or workspace state belong in the public landing repo.
The logged-in workspace is being prepared.
The public site stays at sophosai.app. The authenticated product will live at studio.sophosai.app: user accounts, personal workspaces, protected Workspace Shell, and Fly.io-backed workspace runtimes.
Architecture decision: keep marketing separate from Studio. This page is a public bridge for now; when auth is ready, Launch Studio can point directly to https://studio.sophosai.app.
what will move behind login
User accounts and sessionsStudio
Workspace dashboardStudio
Fly.io microVM/runtime provisioningBackend
Agent runs, files, docs, and app panelsProtected
what stays public
Marketing pagessophosai.app
Product explanationpublic
Beta request formpublic
Privacy, about, contactpublic
Professional product path
Visitors can understand SophosAI publicly, then launch into a separate logged-in Studio when ready.
Easy future switch
When Studio auth is ready, this page can redirect or the Launch Studio CTA can point to the app subdomain.