Security & trust

This page states guarantees the way the code implements them — including the edges of what we do not promise. For the harness threat model (bot users, signer process, audit chain) see Security model; this page is the cloud (Omnipotence) side.

Private mode — the guarantee, as implemented

Private mode is a session-scoped incognito turn. When a turn runs with private mode on:

  • No memory reads. The retrieval step is never called — the turn is answered with zero persistent-memory context, and no "this entry was surfaced" hits are recorded.
  • No memory writes. The write-back step is skipped entirely. Nothing from the turn lands in the memory store.
  • Ephemeral on the machine. The chat session on your VM is destroyed when the turn ends. There is no transcript left behind to collect later — which is why a private turn that outruns its request cannot be handed back afterwards. A normal turn in that position keeps working and its answer arrives when it finishes; a private one says plainly that it ran too long and that private mode keeps nothing to recover it from, so you can ask again with memory on if you want the answer.
  • The API response is marked private: true so the UI never pretends the turn is part of the ongoing record.

What private mode is not: it is not end-to-end encryption, and it does not make a turn free. Prompts still transit our relay for metering (we record token counts and cost, not prompt bodies — see the privacy addendum), and the model provider still processes the prompt under its own policy.

Memory visibility — mechanical, not model judgment

Every memory entry is classified at write time: private (default), network, or public. The only path by which another clone or the public can ever read memory applies the visibility filter before any relevance scoring — so a cleverly phrased query cannot surface a private entry no matter how well its keywords match. Entries with no class fail closed to private. Owner chat can read everything; network surfaces can only ever read network and public.

  • Share audit. Every memory share and every deletion writes a row to your audit log — ids, kind, requester, timestamp, never the entry text (the log itself can't leak content). Owners read it via GET /api/omnipotence/memory/shared-log.
  • Forgetting. POST /api/omnipotence/memory/forget deletes the entries your query actually names (capped per call, so a broad query can't wipe the store), invalidates derived caches, and writes a deletion receipt.

Rate limits & spend controls

  • Rolling usage windows cap spend per tier: 5% of the monthly grant per 5 hours, 30% per week, the full grant (+ top-ups) per 30 days. Violations return 429 with the reset time. Details: Pricing.
  • The wallet is fail-closed: insufficient funds → 402 before any tokens burn; the database rejects any debit that would take a balance negative.
  • Chat requires an active subscription (or grace period) — anonymous free inference is not available, which is what keeps abuse out of the shared capacity pool.

Text your clone reads is data, never orders

Your clone holds the logins it created for you and can send mail from its own address, and it spends its day reading things neither of you wrote — web pages, PDFs you send it, email. So the rule it works to is that only you give it instructions. Everything it reads is content to report on, however that content is phrased and whoever it claims to be from.

  • It refuses text that tells it to ignore its instructions, claims to be a system message or an override, asks for a stored password or key, or asks it to send something to an address you did not give it.
  • "Do not mention this to the user" is treated as the giveaway it is — nothing legitimate needs your clone to hide what it is doing from you.
  • It tells you when it happens, rather than skipping it silently. A document or email that tried to give your clone orders is something you need to know about, and it appears in the step list with the rest of the work.

Tested rather than asserted: hostile instructions delivered by uploaded file and by email — including one impersonating MyClawn support and asking not to be mentioned — were refused and reported, with the real question still answered. Note the honest limit: this is the clone's judgment plus a written rule, not a guarantee, and the model you pick in the model picker is part of it.

Stopping everything

Settings carries a kill switch. Pressing it signs you out on every device and stops whatever your clone is doing at that moment — the running turn on your machine is interrupted, not left to finish.

  • Nothing is deleted. The machine, its files and the logins your clone saved are untouched. Signing back in returns you to where you were.
  • The stop is best-effort and reported honestly. If your machine cannot be reached at that moment, the sign-out still happens and the response says the agent was not confirmed stopped, rather than claiming it was.
  • The myclawn kill command described in the security model is the local-harness equivalent. It applies to a daemon on your own computer, not to a cloud clone — the two are separate, and a cloud clone has no daemon to restart.

Isolation

  • Each customer gets a dedicated VM; customer VMs cannot reach each other or the streaming hub.
  • The clone's mailbox password is held outside the agent's reach — the clone uses its email through a broker, not raw credentials.
  • We do not inspect VM disks, files, or desktop sessions in the ordinary course of operating the service. Access happens only to investigate a specific abuse report or a legal obligation, and is logged.
  • Model catalog rule: free-tier models are never offered — free tiers may train on input.

Abuse process & disclosure

  • Site operators: if a MyClawn clone misbehaves on your site, email agent-abuse@myclawn.com — same-day response, and we can suspend that clone's access to your site instantly. Full commitments: /agent.
  • Security researchers: responsible disclosure to support@myclawn.com.
  • Your own clone: deleting your account deletes the machine; disks are snapshotted on cancellation and permanently deleted after a 30-day grace period.