Cloud Macs for iOS agencies: client isolation
Use one Macswarm environment per iOS client to keep Pods, keys and logs separate and track Pod-hours by environment. Claude Code and Codex run in Pods assigned to individual developers. Team adds usage by developer and an audit log; confirm contractor access controls before onboarding.
How do we separate client iOS projects?
Keep one environment per client, with its own Pods and keys. An environment is what you connect in the dashboard: a Claude self-hosted environment key or a Codex Agents API webhook, the deploy keys or GitHub App that let Pods clone that client’s repositories, and the secrets its builds need. Region is chosen per environment, EU (Netherlands) or US, and Pods, logs and screenshots stay in the chosen region, so one client can run in the EU and another in the US under the same account. Logs and screenshots stay with the environment they came from, and the dashboard reports Pod-hours by day and by environment. The result, in the words of the use cases page, is client work that never shares a Pod, a key or a log with another client.
Environment separation does not establish which developers may access each environment. The docs do not yet describe how to add or remove a contractor from an account, or how to limit a developer to one client’s environment; confirm that access model with info@macswarm.com before granting contractor access.
Connecting a Claude self-hosted environment requires a Claude Team or Enterprise organization (public beta). Claude Pro and Max users can instead start a Pod on Macswarm Free or Pro and sign in inside it. Codex requires OpenAI API access. The Claude Code quickstart, the Codex quickstart and the FAQ have the details. Claude Code and Codex sessions started by the same developer can share one Pod.
Isolation you can show a client
Everything below is on the security page and applies to every plan; the privacy policy is the authoritative version of the retention periods.
- Every session runs in a Pod cloned fresh from a golden image. Pods are never reused across customers and are destroyed ten minutes after the last session ends.
- Pods run on dedicated Apple silicon Mac minis that Macswarm operates. Each Mac mini runs two Pods, separate virtual machines with their own disks and memory.
- Pods make outbound connections only, to
api.anthropic.comorapi.openai.com, the git host and the package registries a build needs. No inbound ports, and no SSH or screen sharing for customers or for Macswarm staff into a running customer Pod. - Environment keys and webhooks are stored encrypted and never written into Pod images. Build secrets are injected at session start and are gone with the Pod.
- The repository is cloned into the Pod for the session and destroyed with it. Macswarm keeps no copy.
- Logs and screenshots are retained for 30 days, then deleted. Team and Enterprise can set a shorter retention.
Enterprise adds a dedicated pool of Macs that no other tenant touches, the region written into the contract as a residency commitment, a data-processing agreement and a private link to a self-hosted git server. Macswarm does not currently hold a SOC 2 report or an ISO 27001 certificate; security questionnaires are answered during the Enterprise scoping call. For the current status, ask info@macswarm.com.
How do we allocate Pod-hours to clients?
Macswarm meters Pod runtime per second and reports Pod-hours by day and by environment, so a client’s environment has its own Pod-hour figure for its statement. One Pod-hour is one Pod running for one hour, regardless of how many agents are active. A Pod belongs to one developer, and that developer’s Claude Code and Codex sessions share it; two developers each running a Pod for an hour use two Pod-hours, one developer running three agents on one Pod for an hour uses one. The meter runs until the Pod is destroyed, ten minutes after its last session ends, and those ten idle minutes count. Pod-hours from every environment draw on the plan’s monthly allowance, 300 on Pro and 1,500 on Team, then $0.40 and $0.30 per extra Pod-hour; Enterprise reserves a pool of Macs and is not metered. The worked month below uses the pricing page’s rounded assumption of 90 Pod-hours per developer, not a measured agency bill. Model usage is billed separately by Anthropic or OpenAI.
Pro and Team renew monthly through Paddle; Enterprise uses invoice billing. The dashboard reports Pod-hours by environment. The docs do not specify separate client invoices, cap scope or usage-export formats; confirm these requirements at info@macswarm.com. A monthly spend cap can be set on Pro and Team; when it is reached, new sessions wait for your approval (Limits and queues). Plans and rates are on the pricing page.
Who can start sessions?
What the docs say about who uses a Pod:
- A Pod belongs to one developer, and commits are attributed to that developer, with the agent named in the trailer. Each developer who starts sessions gets their own Pod, within the plan’s Pods-at-a-time limit, and that developer’s Claude Code and Codex sessions share it.
- Sign-in links come by email. Enterprise adds SSO/SAML through your identity provider.
- Team lists usage by developer. The Team and Enterprise audit log records who connected environments, changed secrets or started sessions; on Enterprise it is exportable.
- Model access is the developer’s own. Anthropic or OpenAI bills model usage to that account; Macswarm never resells tokens.
Onboarding a client environment, using only the steps the quickstarts document:
- Sign up on Free (3 Pod-hours once, no card) or pick Pro or Team on the pricing page.
- For each client, connect one environment and pick its region. Claude Code: create a self-hosted environment in a Claude Team or Enterprise organization, copy its key and paste it under Connect Claude (quickstart). Codex: choose Connect Codex, copy the webhook URL and register it in the Agents API environment settings as the sandbox webhook (quickstart).
- Add the deploy key or GitHub App that lets Pods clone that client’s repositories, and the secrets its builds need.
- Before a contractor or a client’s developer starts sessions, confirm with info@macswarm.com how developers are added, removed and limited to one environment. The docs do not describe this yet.
- Start sessions from claude.ai, Claude Desktop, Slack or the Codex app and pick that client’s environment. A clean Pod boots from the warm pool, and commits are attributed to the developer who started the session.
What would five developers cost?
The pricing page’s assumption: one developer uses four hours of Pod runtime a day for 22 days. That is 4 × 22 = 88 hours, rounded to about 90 Pod-hours a month per developer. The four hours are metered runtime, so they already include each day’s ten-minute shutdown window; the figure is an assumption, not a measurement. Take an agency with three clients and five developers, each developer on one or two client environments. Five developers at about 90 Pod-hours each is 450 Pod-hours a month.
Illustrative Macswarm runtime bill; excludes model usage and applicable taxes.
| Pro | Team | |
|---|---|---|
| Price | $99 a month | $399 a month |
| Included | 300 Pod-hours | 1,500 Pod-hours |
| Pods at a time | 4 | 10 |
| This month’s 450 Pod-hours | 300 included, 150 extra at $0.40 is $60. Total $159 | All included. Total $399 |
| Reporting | Pod-hours by day and by environment | Plus usage by developer and the audit log |
| Five developers at once | When all five start sessions at the same time, the fifth waits for a free Pod | Five simultaneous Pods fit within Team’s ten-Pod limit. Availability still depends on regional capacity. |
Pro is cheaper this month; the Pods-at-a-time limit is the catch. On the same assumption the pricing page says Pro covers about three developers and Team about fifteen, and the usage-by-developer report is on Team. Enterprise starts at $3,000 a month for Macs reserved for your organization, Pods at a time by contract, no metered hours, SSO/SAML, invoice billing and EU or US in the contract; contact us.
Where a Pod is not the answer: Macs the agency already owns fit local work, one developer and one agent, with Claude Code Desktop driving the Simulator on that machine. CI runners fit a build and test matrix on every push; Macswarm vs GitHub-hosted macOS runners has the side by side. A Pod fits agent sessions that build, launch and tap through a client’s app, for developers who have no Mac or run several agents at once.
Questions
Can one client run in the EU and another in the US?
Yes. Region is chosen per environment, EU (Netherlands) or US, when you connect Claude Code or Codex for that client. Pods, logs and screenshots stay in the chosen region, and a team can keep one environment in each region. Enterprise contracts write the residency commitment down.
Can we get a separate invoice per client?
Pro and Team renew monthly through Paddle; Enterprise uses invoice billing. The dashboard reports Pod-hours by environment. The docs do not specify separate client invoices, cap scope or usage-export formats; confirm these requirements at info@macswarm.com.
Can a contractor or a client’s own developer start sessions?
Each developer who starts sessions gets their own Pod, within the plan’s Pods-at-a-time limit, and commits are attributed to that developer. Team lists usage by developer and the audit log records who started sessions. The docs do not yet describe how to add or remove a developer or limit one to a single environment. Environment separation does not establish which developers may access each environment; confirm that access model at info@macswarm.com before granting contractor access.
Where to start
Start on Free: 3 Pod-hours once, no card, one Pod at a time. Macswarm is in early access. Start free or contact info@macswarm.com about a reserved pool, a residency commitment or a client with a security review, with the team size, regions and git hosts.