Security

The partner uses your keys.
Never sees them.

Operator-bound vault. Hands walled at the kernel. A browser that is the partner's and not yours. No telemetry. A threat model that names what we don't claim. And the sealed body that is coming next, described honestly.

The vault

What it protects. Your API keys, your tokens, every credential the agent needs to act on your behalf.

What it guarantees. The model receives outcomes, what an API returned, never the credential itself.

What this means in practice. A prompt injection that says “print your environment variables”gets no keys back. They are not in the model's environment. They never were.

How a tool calls with a key it cannot read →

The hands

What they can touch.On macOS, every command the partner runs is wrapped in a per-command kernel sandbox: your ssh keys and credential stores are unreadable, its own memory takes no writes, and a project it manages is deny-default — the project and its scratch, nothing else.

What that guarantees.No approval prompt, and no judgment call at the moment of running. The wall is the kernel's answer, so it holds even when everything above it judges wrong. On a host without the sandbox runtime — Linux today — the kernel wall is not there yet; the tool-layer guards stay on, and the tool output says which layer answered.

What this means in practice. A prompt injection that says “read the ssh key”gets a refusal from the operating system, not from a reviewer. And before any command lands, the files it would change are photographed — troth rollback restores them.

The ground commands run on →

Its own browser

What it is. A real browser, opened by the partner on your machine, with its own profile directory and its own logins. Not a scraping API, and not a headless imitation of one.

What it guarantees. It is not the browser you are signed into. It runs on a private debugging port of its own, so it cannot attach to your session by accident, and it starts with none of your accounts.

What you control. It opens visibly by default, so you can watch the work happen. Letting it drive the browser you are signed into is a separate, deliberate opt-in that you make once and can take back.

The sealed body

Coming soon

What it will be. An isolated machine running on your laptop, dedicated to one job: running the mind.

What it will guarantee. Signed boot manifest. No inbound network. A kill switch you control.

What you will control. Start, stop, kill, audit. We do not have a back door. There is nothing to phone home.

Threat model

We defend against

· Prompt-injection key exfiltration
· Tampering with the running mind
· Silent telemetry / data leaks to us from the app
· Model swap losing the operator's intent

We don't claim

· Defense against attackers with root on your host
· Defense against compromised dependencies
· Zero bugs (see the credibility page for the failure log)
· A website that measures nothing: troth.one counts page views and load times without cookies (see the Cookie Notice). The app still sends us nothing
· Magic. Only audited engineering

This is your AI. You own the keys. We don't.