Security
We hold the one password your agent can’t. Here is exactly how.
Your agent’s maker decided it should never hold a raw password, and they were right. That makes us the ones you have to trust, so this page says plainly what we do, what we keep, and what happens when something goes wrong.
The path of one call
The agent never talks to the vault
Each call is checked against your token and your rules before it goes anywhere. Only one program ever receives your password, and your agent can’t reach it.
Your agent
Holds one agent token. Asks for an action, like mail.search.
Front door
Checks the token against its hash, then your rules: is this tool switched on for this agent? The call is written to the log.
Connector
Does the work, keeps to your send limits and hides sign-in codes. It holds a handle to your password, never the password.
Mail session
The one program the vault hands a password to, so it can sign in to your provider. It has no keys and no database.
Vault
Keeps passwords encrypted and has no public address. It, not the caller, decides which server a password may go to.
Only the mail session can ask the vault for a password, and only to sign in to your provider. Nothing can show one to a browser or an agent: a stored password can be replaced or deleted from your dashboard, never read back, not even by you.
What we promise
Six things that hold on day one
These are the bar for launch, not a plan for later.
Passwords go in and never come out
A stored password can be replaced or deleted, never shown again. Automated tests plant fake secrets and fail the build if one appears in a reply, a log or an error.
A key that is yours alone
Your browser encrypts the password for the vault before it is sent, so our web servers only carry it sealed. In the vault it sits under a key made for your account, itself encrypted under a master key.
Read first, write by choice
Read tools are on from the start. Writing is off until you turn it on, and each write tool then has a switch of its own. Turn writing on with none of them chosen and they all come on, ready to be turned off one at a time.
Codes and reset links are hidden
One-time codes, password-reset links and magic sign-in links are taken out before your agent reads a message. It works by reading the text, so it catches the wordings we know and cannot promise every one. You can turn it off for a connector.
Sending has a ceiling
A daily cap, a recipient cap, a pause after a bounce and an optional list of who may be written to. A confused agent can’t spam from your address.
Off means off
Revoking a token stops calls within 5 seconds. Deleting your account deletes your passwords and tokens right away, and the audit log within 24 hours.
Your data
What we keep, and what only passes through
Nothing here is used for training or advertising, and there are no third-party trackers on this site or in the dashboard.
| What | Kept? | How, and for how long |
|---|---|---|
| Your app-specific password | Stored, encrypted | Until you delete it here. Cancel it at Apple and our copy stops working at once. |
| Your name, email address and passkeys | Stored | To sign you in. A passkey is a public key, and there is no account password to steal. |
| The audit log | Stored | Tool, time, which token, where it went, result and how long it took. 30 days on Free, 1 year on Personal. |
| Your switches, limits and recipient list | Stored | So your rules hold on every call. Deleted with your account. |
| New-mail notices waiting for your agent | Stored | Who a new message is from, its first three recipients and its subject, with codes and sign-in links hidden while hiding is on, and never its text. Kept until your agent picks it up, for 7 days and 200 notices per mailbox at most, and deleted when you switch new-mail events off or disconnect the mailbox. Cloudflare encrypts it where it is stored; the vault, which guards your password, does not. |
| Webhook deliveries waiting for your agent | Stored | What a service posted to your inbox: its body, its query, and the few headers that say what it is, never a credential or a signature. Kept until your agent picks it up, for 7 days and 200 deliveries per inbox at most, and deleted with the inbox. The address holds a secret we keep only a hash of. Cloudflare encrypts it where it is stored; the vault does not. |
| Your inboxes’ signing secrets | Stored, encrypted | In the vault, as a password is, and used there only to check a sender’s signature. Never sent anywhere or shown again. Deleted when you stop checking signatures or delete the inbox. |
| Messages, attachments, events and contacts | Never stored | Passed to your agent in memory and gone when the call ends. |
| What your agent asked for | Never stored | Search words, recipients and other inputs are never written to the log. Each call keeps a fingerprint of them, which tells two identical calls from two different ones. Nothing can be read back out of it, though somebody holding the database could use it to check a guess. |
| Your agent token | Never stored | We keep a hash and the first few characters, enough to recognise it. |
- Your app-specific passwordStored, encrypted
Until you delete it here. Cancel it at Apple and our copy stops working at once.
- Your name, email address and passkeysStored
To sign you in. A passkey is a public key, and there is no account password to steal.
- The audit logStored
Tool, time, which token, where it went, result and how long it took. 30 days on Free, 1 year on Personal.
- Your switches, limits and recipient listStored
So your rules hold on every call. Deleted with your account.
- New-mail notices waiting for your agentStored
Who a new message is from, its first three recipients and its subject, with codes and sign-in links hidden while hiding is on, and never its text. Kept until your agent picks it up, for 7 days and 200 notices per mailbox at most, and deleted when you switch new-mail events off or disconnect the mailbox. Cloudflare encrypts it where it is stored; the vault, which guards your password, does not.
- Webhook deliveries waiting for your agentStored
What a service posted to your inbox: its body, its query, and the few headers that say what it is, never a credential or a signature. Kept until your agent picks it up, for 7 days and 200 deliveries per inbox at most, and deleted with the inbox. The address holds a secret we keep only a hash of. Cloudflare encrypts it where it is stored; the vault does not.
- Your inboxes’ signing secretsStored, encrypted
In the vault, as a password is, and used there only to check a sender’s signature. Never sent anywhere or shown again. Deleted when you stop checking signatures or delete the inbox.
- Messages, attachments, events and contactsNever stored
Passed to your agent in memory and gone when the call ends.
- What your agent asked forNever stored
Search words, recipients and other inputs are never written to the log. Each call keeps a fingerprint of them, which tells two identical calls from two different ones. Nothing can be read back out of it, though somebody holding the database could use it to check a guess.
- Your agent tokenNever stored
We keep a hash and the first few characters, enough to recognise it.
One thing to know: whatever your agent asks for is sent to your agent, and from there it is in the hands of whoever runs that agent, under their terms. We are the carrier for that handover.
When things go wrong
What each failure can and can’t reach
Check our work
What you can verify today, and what is not there yet.
- Every call
- In your audit log, with export
- Our access
- Listed at Apple. Cancel it there
- Dependencies
- Pinned, never “latest”
- Independent audit
- None yet
Found a problem?
Tell us first. We read every report and reply as soon as we can.
- security@muse.space
- Machine-readable
- /.well-known/security.txt
- First reply
- As soon as we can
- Bounty
- Planned once there is revenue