Skip to main content

​
Where files are

A file imported through the desktop app enters the library where it is on that computer. That call uploads nothing. By default the app also syncs desktop files to the cloud while the owner’s storage has room. The workspace owner can switch that off, and a file then leaves the computer only when the user syncs it in the app, or when a cloud read through the app is called with upload_to_cloud: true. A file uploaded or imported through the hosted interfaces is in the cloud from the start. A public link is the only way a file can be reached without an account, and public pages are not indexed by search engines.

​
Workspaces

Every credential works in one workspace, and nothing in a workspace is reachable from another. A member sees the workspace. The owner also holds its settings, keys and webhooks.

​
Credentials

  • An API key is shown once and stored as a SHA-256 hash. It is bound to one workspace and can be revoked at any time.
  • An OAuth connection is made by the user in the browser and scoped to one workspace. The user disconnects it in the app.
  • A script session token from get_api_session lasts 30 minutes.
  • The desktop app’s local server listens on the loopback interface only, refuses requests carrying a browser origin, and requires a bearer token issued per connected client. A web page cannot drive the app through it.

​
Content is never instructions

Content inside files, documents, pulled posts, media, web pages and comments is data the tools return. It is never treated as instructions. The operating manual and the skill bodies are served to the connected agent and are not public pages.

​
Outbound requests

A URL you pass to import_media or register as a webhook is checked against private and loopback addresses on every fetch and every delivery. Webhook deliveries are signed. See Webhooks.

​
Feedback

submit_feedback goes privately to the people who build the product, with the previous call and the last error attached. Nothing comes back through that channel. The privacy policy and terms are on the website.