Security

• At rest. Messages, credentials and API keys are encrypted before they are stored. Credentials use AES-256-GCM with a fresh nonce per value, and each ciphertext is bound to its owner and connection, so a value copied to another row does not decrypt.
• Key rotation. Encryption keys live in a versioned keyring. A new key can be made active without re-issuing credentials, and old ciphertexts stay readable until they are re-encrypted.
• In transit. The app talks to the service over TLS, and the live screen stream is authenticated before a connection is opened.

• Your crew works on one sandboxed computer of its own, isolated from every other customer’s.
• Each bot has its own screen (its own display) and its own browser on that computer.
• Bots share files and the logins you give them, so work can pass between them; each keeps its own folders.
• Secrets never enter your crew’s computer. Model keys and plugin tokens stay on the server, which makes the calls on the bot’s behalf.
• Every request is checked against the account that owns the bot, screen or file it asks for, and a request for someone else’s answers exactly like one for something that does not exist.

You set, per bot, how much it may do without asking: ask before anything that changes something, ask only when it reaches outside the crew’s computer (the default), or full access. When a bot asks, the action waits until you approve or decline it.

• Sign-in is through Google, GitHub or a one-time emailed link. We never see or store a password.
• The desktop app keeps its session in the operating system’s secure storage.

You choose the region your data lives in when you sign up. You can ask for an audit or a privacy report at any time. Details are in the Privacy Policy.

The whole service (the orchestrator, the bots’ computers and the database) can run on your own infrastructure, under your own controls, for free. See Self-host. The Custom plan is help setting it up and running it.

If you find a security issue, write to [security email] with the steps to reproduce it. We will confirm we received it within two business days and keep you updated until it is fixed.

Please give us a reasonable time to fix it before disclosing it, do not access or change other people’s data, and do not degrade the service while testing. We will not pursue good faith research that follows these rules.