Local key custody
Secrets are stored in your OS keychain and encrypted at rest on your device — never uploaded.
Security & Trust
The agent cannot approve its own work
An agent here can read, draft, enrich and route all day. It cannot send the email, make the payment, or push to production — not because we told it not to, but because the queue will not hand it that item. Your credentials never reach our cloud, so there is nothing on our side to leak.
Human-in-the-loop
The Golden Rule
The AI does everything up to an external side-effect. Then a human approves. Nothing that leaves your walls — an email, a payment, a post, a write to another system — fires without a recorded human decision.
- Autonomous for reading, drafting, enriching and routing
- A hard stop at every external side-effect
- Every approval is logged for audit
- No prompt-injected instruction can bypass the gate
The approval boundary
Green is autonomous. The wall is the human gate.
Zero-knowledge secrets
The cloud can’t leak what it never held
Credentials live on your machine, encrypted at rest. External work runs on the local agent. Our control plane orchestrates work items — it never sees your plaintext secrets. That’s a guarantee centralized BPM and iPaaS architecturally can’t make.
Edge execution
Anything touching an external system runs on the agent, from your network — not a shared cloud.
Regulated-ready
Because plaintext never centralizes, the model fits PHI and other regulated data by design.
Trust pillars
Verifiable, not just assertable
It runs on your hardware
The agent runs on your hardware, so you can watch what it does: its process, its network calls, its access to your files. Source opens at general availability. Until then, trust the boundary rather than our word for it — the cloud never receives a plaintext credential, so there is nothing there to leak.
Full audit trail
Every move on a work item is recorded: who did it, when, and whether the actor was a person or an agent. You can reconstruct who approved what. What happens inside a model's own reasoning is not recorded — the trail is of actions taken, not thoughts had.
Tenant isolation & RBAC
Multi-tenant organizations keep each team’s data separate, with role-based access controls and scoped caller identity.
Enterprise key recovery
Zero-knowledge by default; on Enterprise, admin-recoverable secrets provide continuity without handing plaintext to the cloud.
Automation you can actually trust.
Human approval on every external action, zero-knowledge secrets, and a client that runs on your hardware rather than ours.