Security
Updated 2026-09-16
One machine per agent
Each agent runs in its own isolated machine, with its own disk and terminal. Two agents from two accounts share no process, file system or local network. What an agent writes to its disk is seen only by it.
Machines go to sleep when nobody uses them and are destroyed if their owner deletes the agent.
Your keys
- The provider keys (Claude, OpenAI, DeepSeek) you paste in Credentials are stored encrypted (AES-256-GCM) in your account's vault and only injected into your agents' machines.
- Connectors (Google, Canva…) store their token under
(your user, provider); disconnecting revokes at the provider. - An agent's ACP token is shown to you once and can be rotated; the old one dies instantly.
- Third-party OAuth2 tokens rotate on every refresh; reusing an old one revokes the whole family.
The agent acts as whoever invokes it
An agent can only do what the person who spoke to it could do. In Teams, each turn's tools carry a five-minute credential scoped to that person and that workspace. On a public channel (WhatsApp) there are no personal connectors and no destructive actions.
Sensitive actions ask the client for permission before running; with no reply in ten minutes, they are denied.
Network
Credential-based connectors (Odoo) only accept public hosts: no private IPs and no localhost, so a connector can't be used to reach your network from the agent's machine.
Files
Your account's files are served through a 6-hour signed URL. The agent's machine never receives storage keys; it receives a URL that expires.
Deleting the account
DELETE /api/v2/me (or Settings → Delete account) removes agents, machines, conversations and files. If the account owns a workspace with other members, it responds 409 with the block: it has to be transferred first.
Reporting a vulnerability
Write to with the subject "security". We reply within 48 hours.