Built like it records your work. Because it does.

Principles

• Minimize what's collected. Only allow-listed apps, only text and structure, no keystrokes, no learning screenshots.
• Remove secrets before they leave your Mac. Redaction runs on the device and again on the server.
• Show the source of everything. Every learned line cites the moment it came from, and you can delete any of it.
• Never commit without you. The agent pauses before anything that sends, submits, pays or deletes.

What capture reads

The Mac app watches the macOS accessibility tree of apps and sites on your allow-list: window titles, URLs in browsers, the element you clicked (role, title and position in the tree — not raw coordinates), and field values as they change (“Status: Open → Pending”), read when you leave the field.

• No keystroke logging. Input Monitoring permission is never requested.
• No screenshots while learning. Screen Recording is used only during agent runs you start.
• Always excluded: password managers (1Password, Bitwarden, LastPass, Keychain Access, Passwords), private and incognito windows, sign-in, checkout and payment pages, and secure text fields, which are never read.

On-device redaction

Before anything is uploaded, the desktop app replaces sensitive values with typed placeholders such as [CARD] and [SECRET]:

• card numbers (pattern match plus Luhn check), IBANs and bank account formats, SSNs and national IDs;
• API keys and tokens (known prefixes such as sk-, AKIA, ghp_, plus a high-entropy check);
• JWTs and private key blocks.

The same rules run again on the server as a second check. When your Mac is offline, events wait in an encrypted local queue whose key is held in the Keychain.

Storage & encryption

Data is stored in AWS (us-east-1) in S3 with SSE-KMS encryption. Every object is encrypted with your user id as the KMS encryption context, so a request for one user's object can't be decrypted under another's context. All traffic uses TLS. S3 versioning is on, and agent audit logs are written under S3 Object Lock.

Per-user isolation

Every storage path and index key is built from your authenticated user id inside a single data-access module — never from request input. Automated tests check that one user can't read or write another's data. Search vectors are filtered by user id on every query.

Authentication

• The web app and MCP server use Clerk. Claude connects to the MCP server with OAuth 2.1.
• The Mac app's background services use a revocable per-device credential: a device secret kept in the Keychain is exchanged for short-lived device tokens. Revoke a device in Settings and token exchange stops immediately.

Agent safety

• Runs on your Mac, in apps you're already signed in to. Your passwords are never handed to the agent.
• Commit gate: before any click or key, the executor checks the target element. Anything that matches commit patterns (Send, Submit, Pay, Refund, Delete, Approve, Merge, Post…) or a step marked commit waits for your approval in the overlay, the web app or Claude.
• Scope: actions outside the work package's allowed apps and domains are refused.
• Budgets: each run has step, time and token limits.
• Kill switch: press Esc twice, or use Stop in the menu bar.
• Escalation, not improvisation: if a case isn't covered by the playbook, the agent stops and hands it back.
• Audit: every action, element, before/after change, decision, approval and screenshot is written to an append-only log.
• Autonomy is earned: a playbook can run without approvals only after you promote it, by default after 5 supervised runs with no failures.

Prompt injection

Captured content is always passed to models as data, inside clearly delimited blocks, with instructions to ignore commands found in it. Commit actions are enforced in code on your Mac, so nothing on screen or in a document can unlock them.

Desktop app hardening

The Mac app's window runs with context isolation and sandboxing on and Node integration off. Navigation is limited to zeus.yskew.com and Clerk; other links open in your browser. The web UI reaches native code only through a small set of typed functions — there's no generic IPC.

Retention & your controls

• Raw recordings are deleted after a window you choose (default 30 days). What was learned is kept until you delete it.
• See everything learned along with its source. Forget any episode, fact or playbook.
• Pause capture, or forget the last 15 minutes, hour or day, from the menu bar.
• Export all data or delete all data from Settings. Deletion removes storage prefixes, index rows, vectors and any files uploaded to model providers.

Subprocessors

Compliance

SOC 2 is on our roadmap. Access logging, change management and backups are built in from the start so the controls are in place before the audit.

Reporting a vulnerability

Email security@zeus.yskew.com with details and steps to reproduce. We acknowledge reports within two business days and won't pursue good-faith research that respects user privacy.