Security
Agents do real work: they run shell commands, open your browser, send email. This page explains the controls around that. It describes what the product does today; items still missing are listed at the end.
Agent permissions
Every tool an agent can use has a permission: allow, ask or deny.
Defaults. Agents are built to finish work without stopping at every step, so by default they may:
- run shell commands, read and write files on the cloud VM and on machines you attach,
- browse and search the web, use the Vault by reference.
Image generation, the TODO for AI API and changing agent settings are denied by default. Anything not covered by a rule falls back to ask.
Attaching a machine therefore gives agents access to it. For production servers or shared inboxes, set the relevant tools to ask or deny.
- Set them in Agent settings (Alt+G) → Advanced → Permissions, globally or per agent.
- Approve & remember saves a rule, so you are not asked for the same kind of action again.
- Settings → Behavior → Auto-run shell commands controls whether shell commands need approval.
- Every step an agent takes is visible in the TODO chat and stays in its history.
Where agents run
| Where | Isolation |
|---|---|
| Cloud VM | Each user gets their own Firecracker microVM. It is not shared with other customers. |
| Your PC / server (Bridge, desktop app, CLI) | Runs as your OS user with your permissions. Only connected while the Bridge runs; stop it to cut access. |
| Your browser (extension) | Only tabs you attach are visible to agents. Others stay private. |
Pick where each agent may work in Agent settings → Advanced → Where your agent works.
Bridge connection
The Bridge talks to the backend over a WebSocket with its own encryption layer: Noise_NX_25519_ChaChaPoly_BLAKE2b on top of TLS. The backend is the Noise responder, so the channel is encrypted between your machine and our backend (not between your machine and another client). The Bridge is open source: github.com/todoforai/bridge.
Secrets (Vault)
- Secrets you store in the Vault are encrypted with AES-256-GCM, bound to your user and the secret's path.
- Agents use them by reference, so values do not need to be pasted into chat.
- Vault values are excluded from data exports and deleted with your account.
Connected accounts
Connectors (Gmail, Slack, GitHub …) use the provider's own OAuth or your API key. You choose which accounts to connect and can revoke access in the app or with the provider at any time.
Network and accounts
- TLS 1.2+ for all external connections. Cloudflare provides DDoS protection.
- Sign-in by email code or Google. No passwords stored.
- Settings → Data Control → Invalidate Others signs out every other session.
- API keys are per user; create and revoke them in Settings → API Keys.
Sharing controls
- Team projects are visible to team members only. Single projects can be shared with Can view or Can edit. See Teams.
- Shared TODO links are read-only. Comments from visitors are off unless you enable them.
- My Private groups are visible only to their owner, even in a shared project.
Availability
Paid plans include a 99.5% monthly uptime target with service credits, per the Service Level Agreement.
Not available yet
- SSO / SAML, SCIM
- Customer-managed encryption keys
- User-facing audit log export
- Running against a local model only
Report a vulnerability
security@todofor.ai. Please include steps to reproduce.