Due diligence, in order

Key handling

Provider keys will stay off devices

Provider credentials will be encrypted at rest in our vault and held only by the gateway. They will never be sent to a device. The desktop app will authenticate with a short-lived, per-user virtual key and will never see a raw provider secret. Virtual keys will be scoped per user, and revocation will reach scheduled work at its next run.

Enforcement

The gateway will be the policy boundary

Entitlements will be evaluated at the gateway on every request. Groups will grant; deny will always win. Because enforcement will happen server-side, a modified or malicious client will not be able to route around policy. If a client lies, it can only ask, and be refused. This boundary will cover the desktop app, mobile companion, browser actuator, muniment CLI, and VS Code companion.

Records

Immutable provenance, exportable

Every privileged decision — a route, a grant change, a policy publish, a denied request — will be written to an append-only audit ledger with the actor, matched rule, cost, and time. Model and provider-deployment registry revisions will be immutable, preserving the exact provenance behind each call. Each model-call receipt's usage and cost will be reconciled from the gateway. Records will export as JSON and CEF for SIEM ingest.

Voice

Desktop voice will stay on the device

On the desktop client, capture, polish, and read-aloud run entirely on local models on the machine — zero voice bytes leave it. The mobile companion uses the platform's native speech services, so mobile voice is not covered by the on-device guarantee.

Sandbox

Tool execution will be sandboxed, honestly

Local and server-side tools will run in a per-invocation sandbox with no ambient credentials. Each call will receive only the scoped connections its policy allows. Filesystem and network access for those tool runs will be deny-by-default. Browser control uses the separate governed trust model described below.

Browser control

A separate, governed trust model

Browser control is a governed runtime capability, not an ambient one: it will drive the user's real browser only under an explicit entitlement, every action bounded by policy, and every action written to the same audit ledger. It is browser-only — no operating-system or general computer control.

Integrity

Integrity — signed builds, honest about preview

Preview desktop installers are not publicly available. Windows packages supplied through your approved release channel are code-signed via Azure Trusted Signing under Green Kangaroo, LLC. Verify the publisher before fleet deployment.

macOS builds remain unsigned pending Apple Developer enrollment; notarization will follow.

Compliance

No borrowed badges

We do not claim certifications we do not hold. Compliance documentation — data handling, subprocessors, tenancy — will be available under NDA once released.

Disclosure

Responsible disclosure

We acknowledge reports within one business day. We do not pursue good-faith researchers.