built so you can check our work
cosigno's security model is simple to state: the agent proposes, you approve, the server enforces. here is exactly what that means — all of it shipped, tested, and visible in your own audit trail.
approval is enforced in the state machine, not the UI
nothing that changes anything outside cosigno executes without your signature — sending, posting, updating, spending, deleting, refunding, and every call to a connected tool. searching, summarising, and drafting clear automatically, because they read or produce text and a draft cannot transmit. every auto-cleared action is logged as auto-cleared, never as approved by you. destructive actions additionally require typed confirmation.
the agent can never escalate its own permissions
the server assigns every action's authority level from its risk class. a request for a lower level is clamped back up, flagged on the card, and logged as a security signal.
external content is treated as an attacker
email bodies, tool outputs, and MCP responses are wrapped as untrusted data and injection-scanned. content that tries to direct the agent produces a flagged, non-executable card — flagged cards can never be approved by a shortcut.
credentials are encrypted and never leave the server
oauth tokens and API keys are encrypted at rest with AES-256-GCM, scoped to your user id, protected by row-level security, decrypted only at the moment of an approved call, and never written to a log or sent to the browser.
user-supplied endpoints can't reach our insides
every URL you connect is SSRF-checked: https only, private/reserved/metadata address ranges blocked, redirects refused, and the host re-verified at call time — with timeouts and response-size caps on every outbound call.
spend is capped before the model is ever touched
unauthenticated requests are rejected before any AI call. per-user rate limits, a global daily circuit breaker, per-call token caps, and oversized-input rejection all run first.
everything is auditable — by you
every proposal, approval, veto, and execution is permanently logged with its exact payload, who signed it, and the result. filterable and exportable from your account.
the kill switch is immediate
disconnect any integration and its stored credentials are deleted at once; its proposals stop immediately. deleting your account cascades through every row you own.
what we won't claim: that cosigno is impossible to hack or risk-free. no software is. what we do claim — and test — is that no action executes without your logged approval, and that you can always answer “what did it do, and who said yes?”