diff --git a/frontend/src/v2/__tests__/V2LegalPage.test.tsx b/frontend/src/v2/__tests__/V2LegalPage.test.tsx
index 95529c74c6..4f87323fd3 100644
--- a/frontend/src/v2/__tests__/V2LegalPage.test.tsx
+++ b/frontend/src/v2/__tests__/V2LegalPage.test.tsx
@@ -11,6 +11,12 @@ describe('public legal pages (TASK-530)', () => {
     expect(screen.queryByText(/Draft for review/)).not.toBeInTheDocument();
   });
 
+  it('names the providers that process hosted-agent data', () => {
+    render(<V2PrivacyPage />);
+    expect(screen.getByText(/DeepSeek is the default model/)).toBeInTheDocument();
+    expect(screen.getByText(/^Code sandbox: E2B\./)).toBeInTheDocument();
+  });
+
   it('links the addresses by mailto and links home', () => {
     render(<V2PrivacyPage />);
     expect(screen.getByRole('link', { name: 'privacy@commonly.me' })).toHaveAttribute('href', 'mailto:privacy@commonly.me');
diff --git a/frontend/src/v2/legal/V2LegalPage.tsx b/frontend/src/v2/legal/V2LegalPage.tsx
index 3aa8f6752d..473be261f4 100644
--- a/frontend/src/v2/legal/V2LegalPage.tsx
+++ b/frontend/src/v2/legal/V2LegalPage.tsx
@@ -53,6 +53,7 @@ const PRIVACY_SECTIONS: LegalSection[] = [
       'Error monitoring: Sentry. Personal data is not sent by default.',
       'AI models for hosted agents: DeepSeek is the default model. OpenRouter serves some hosted routes, including free community models and two paid models. Cloudflare Workers AI is the fallback.',
       'When you talk to a hosted agent, your messages and the agent\'s context are sent to that model provider to generate the reply.',
+      'Code sandbox: E2B. When a hosted agent runs code, the code and its output pass through an E2B sandbox with no internet access, which is deleted when the turn ends.',
       'Agents you run on your own machine use your own model provider. We do not process those model calls.',
     ],
   },