Enterprise File Processing In Your Own Cloud.
Run a pool of Filebot agents inside your environment. Route each step to a healthy, capable agent, keep files in your own buckets, and let the control plane orchestrate without ever reading your bytes.
Run A Cluster Of Agents.
Agents register per organization and form your pool. For each step, Filebot picks the best agent by a least-in-flight heuristic, filtered to ones that are online, capable, and allowed to run it.
- Least-in-flight load heuristic across the pool
- Online status from agent heartbeats
- Capability and provider match
- Strict-privacy support honored
The next step routes to agent-cpu-2, the idlest online agent that can run it.
Dedicate Agents To Processors.
Agents advertise the processors, providers, and processor versions they support through their heartbeat. A step routes only to an agent that advertises what it needs, with optional version pinning.
Capability self-report
Each agent reports the use steps and providers it can run, so the pool knows who can do what.
Capability-matched routing
A step routes only to an agent advertising its required processor and provider.
Version pinning
Pin a processor's contract version or hash so a step runs only on an agent that matches.
Route Compute Per Step.
Every step chooses where it runs with a compute target. Set a pipeline-level default and override it per step.
- cloud: Run on Filebot-managed compute
- agent: Route to your pool
- agent:<id>: Pin a specific agent
Pinned agent:<id> routing sends a step to exactly that agent.
{ "compute": "agent", // pipeline default: your pool "steps": [ { "id": "scan", "use": "file/virusscan", "input": ":original", "compute": "cloud" }, { "id": "thumb", "use": "image/resize", "input": ":scan", "compute": "agent:gpu-1" } ]}Zero Egress, Strict Privacy.
Choose a privacy mode per pipeline. In strict mode, intermediate files stay in your workspace bucket and the control plane never reads object bytes. The agent signs the short-lived handoff URLs between steps and the final delivery URL.
- Standard or strict privacy mode
- Strict keeps intermediate files in your workspace bucket
- Control plane never reads object bytes
- Your buckets on S3, R2, or S3-compatible storage
- Your credentials in an encrypted vault
Object bytes never cross the boundary. Filebot orchestrates by reference only.
Security And Trust.
The controls that make zero-knowledge processing real, end to end.
Signed cross-agent handoffs
Handoffs between agents and the final delivery use short-lived signed URLs.
Encrypted credential vault
Your storage credentials are encrypted at rest with AES-GCM.
SSRF guards
Imports and webhook targets are checked to block requests to internal addresses.
Signed webhooks
Every webhook delivery is signed so you can verify it came from Filebot.
Organization roles
Owner, admin, and member roles scope what each teammate can do.
Audit log
Member and API-key changes are recorded for review.
Bring File Processing Into Your Cloud.
Talk to us about running Filebot agents in your environment.