A phone number is an open door. Ours has a lock.
Anything reachable by text is reachable by anyone. Here's exactly what stands between your assistant and the rest of the world.
Verified at the door
Every inbound text and call webhook is signature-checked against the carrier's secret before it is parsed. Unsigned or replayed requests are rejected outright.
Hard allowlist
Only numbers you approve reach the assistant. Everything else stops before a single model call, so strangers can't read your context or spend your credits.
Isolated by workspace
Every row belongs to a workspace and is protected by row-level security. One account can never read another's threads, tasks or credentials.
Scoped credential grants
Credentials are encrypted at rest and only usable by the bot, for the scope, and for the window you granted. Revoking a grant takes effect immediately.
Approval before risk
Destructive commands, vault access and anything you mark sensitive ask for a one-word confirmation by text before they run.
Immutable audit log
Delegations, commands, logins, approvals and deletions are all recorded with actor, target and timestamp — and exportable.
Practices
The rest of the posture
- Secrets live in server-side storage and are never exposed to the browser.
- Assistant tools are permission-checked on the server, not in the interface.
- Machine agents connect outbound only — nothing is opened on your network.
- Pairing codes are single-use and expire; machine tokens can be revoked instantly.
- Session tokens are short-lived and refreshed automatically.
- You can export or permanently delete any thread, task or credential.
Found something concerning?
Report it from inside your workspace and it goes straight to the audit trail and to us.
Read the docs