Trust
You stay in control. Here is how the product makes sure of it.
Every deliverable waits for your approval
A card reaches Done only when its approver, a person, approves it. In a connected app an agent acts only with the access you give it there, read, write or delete, app by app, and the built-in publishing to social accounts is always a person's action.
How it is enforced: A check on every move to Done that refuses anyone but the card's human approver.
Spend caps are checked before a run, not after
You can cap spend per card, per person, per agent and for the whole workspace. Each run's cost is estimated before the model is called, and a run that would cross a cap does not start.
How it is enforced: A pre-flight estimate against every cap that applies; the strictest wins.
What an agent learns stays with the conversation it learned it in
Every memory, diary entry and learned skill carries the conversation it came from, and only people who can open that conversation see it. A conversation marked confidential is limited to the people in it at that moment. No role, owner or admin included, reads an agent's memory outside its audience.
How it is enforced: An audience on every memory row, checked by the database's access rules and by a build check.
Deleting a conversation deletes what was learned in it
When a conversation is deleted, the memories, diary entries and proposals kept with it are deleted too.
How it is enforced: A database trigger on conversation deletion.
Agents' code runs in a sandbox, never on our servers
Commands, scripts, builds and tests an agent runs go to an isolated cloud computer, one per agent and conversation, never shared between agents or conversations. Its running time counts against your caps.
How it is enforced: One sandbox interface for all agent compute; nothing an agent chooses runs on the app's own servers.
No credentials on an agent's computer, with two exceptions you control
Agents use apps through connections, not passwords. A development secret you save for a project is loaded only into the one command that needs it, with the computer's network locked to that secret's hosts, and the computer is wiped afterwards. And a person, never an agent, may sign in by typing into the live browser beside a chat; that browser's profile is deleted before the computer sleeps.
How it is enforced: Empty command environments, per-use secret loading that is logged, and a browser profile wiped on sleep.
Your own key, or a model you run yourself
A workspace can bring its own Anthropic or OpenRouter key, or point at its own OpenAI-compatible endpoint, Ollama and LM Studio included. Keys are stored encrypted.
How it is enforced: One provider pipeline that every agent run goes through.
Copies of prompts and replies are kept only if the owner opts in
We record each model call's model, tokens, time and cost. A copy of the prompt and reply is kept for analysis only when a workspace owner opts in, never for a confidential conversation, and its text is never shown in our admin tools or logs.
How it is enforced: One recorder for every model call, with payload capture off unless the workspace owner turns it on.
Who processes data for us
As the code stands on 16 October 2026.
| Provider | What for |
|---|---|
| Supabase | Database, sign-in and file storage |
| Railway | Application hosting |
| Inngest | Background jobs |
| Resend | Sending email |
| E2B | Agents' cloud computers (sandboxes) |
| Anthropic, OpenRouter | The language models agents use, unless you bring your own |
| FAL | Image, video and audio generation |
| Deepgram | Speech to text |
| DeepInfra | Text to speech |
| LiveKit | Voice and video rooms |
| Composio | Connections to the apps you connect |
| Cloudflare R2 | Prompt and reply copies, only for workspaces that opted in |
| Sentry | Error reporting |
| Amplitude | Cookieless website and product analytics |
If your workspace uses its own model key or a local model, prompts go to the provider you chose, under your agreement with them. See how it works for where the review step and the caps sit in a card's life.