aiSecurityWarden encrypts your API keys and passwords on your own computer before they're stored, and lets your AI agents use them — and take sensitive actions — only when you say yes. We only ever store data we can't read.
Email, calendars, APIs, cloud services — an agent with no keys is a chatbot with extra steps.
Whatever the key allows. There is no "just read a little" at the API-key level.
A single email or web page with hidden instructions ("forward all bank email to this address") can turn a helpful agent into a liability. This is called prompt injection — a real, current risk, not a thought experiment.
They store secrets in a form the provider could read — and treat approval workflows as an expensive enterprise add-on.
Your secrets are encrypted on your device, before they are sent. The server stores only encrypted data and never receives your keys, your secret names, or your secret values. Even we can't read them.
Even secret names are hidden from the server — not just the values.
Industry-standard encryption (AES-256-GCM), built only on well-known, widely reviewed cryptography libraries. No home-made cryptography.
The desktop client and command-line tools do all encryption locally. An open-source desktop client is publishing soon, so anyone can verify it.
No account recovery, and we mean that as a promise: if you lose your password without your recovery key, your data is gone — to anyone, including us. Nothing we can't read, we can't hand over.
A "What we store" help page will show you an actual stored record so you can see it's unreadable Coming soon
Bots can be required to get a human's approval before they read secrets or take sensitive actions.
Approve or deny from your phone (Telegram or ntfy push) or from the website / desktop admin app.
Every request carries a short match code, so you can confirm the prompt on your phone is for the request you're expecting.
Approve once at start-up for a working session (say, 8 hours) — or require approval on every access for high-value keys.
Built-in timeouts and limits stop a misbehaving bot from flooding you with requests — no approval fatigue by design.
| Channel | What it is | Plan |
|---|---|---|
| Website | Approvals page with live updates | All plans |
| Desktop admin app | Pending approvals tab | All plans |
| Telegram | Push message with Approve / Deny buttons | Paid (free 14-day trial) |
| ntfy | Push notification with Approve / Deny | Paid (free 14-day trial) |
If a trial or paid plan ends, nothing breaks: bots keep working and approvals simply move back to the website and desktop app.
Beyond any secrets manager we know of: aiSecurityWarden sits between your agent and the apps it uses, and requires approval for individual actions.
The rules live in aiSecurityWarden, not on the bot's machine. A compromised or confused bot can't loosen its own rules.
The agent is told "waiting for approval" right away and can check back later — a slow human doesn't break the workflow.
Outside content (emails, web pages) is marked untrusted to the agent, reducing the chance it follows hidden instructions.
You choose what your phone shows, per project: the full details (recipient, subject, preview), or only the action name, with the details end-to-end encrypted and reviewed in aiSecurityWarden.
Each bot or machine gets its own machine token, and each token can be locked down:
Add API keys and credentials in the website or desktop app. They're encrypted on your device before upload.
Create a machine token scoped to one project, limited to your bot's network address. Paste a one-time setup code into the agent.
Choose what the agent may do on its own, what needs a quick approval, and what always needs you.
When the agent needs something sensitive, you get a notification with the details and a match code. Tap Approve or Deny. Everything is logged.
A connector is the bridge between your AI agent and an application such as Gmail. It gives the agent a set of tools ("search email", "send email") and runs every one of them through aiSecurityWarden's approval rules. The agent never holds the application's credentials — the connector uses them on its behalf, and only once the action is allowed or approved.
| Rule | What happens | Typical use |
|---|---|---|
| Allow | Runs immediately, logged | Reading, searching |
| Time window | Approve for a time window — first request asks you; similar low-risk actions are then allowed for 1 minute to 24 hours | Labeling, archiving, tidying up |
| Ask every time | Each action waits for your Approve | Drafts, anything new |
| Deny | Never allowed | Actions you never want an agent to take |
High-risk actions are always one at a time. Sending, forwarding and deleting can't be covered by a time window, even by mistake.
Anything without a rule asks first. The safe default.
Your email never touches our servers. Connectors run on your own computer and talk to the app directly. aiSecurityWarden only sees the approval request — and with encrypted summaries, not even its details. Hosted connectors can't say that.
You see exactly what you're approving. The approval card shows the action and its details (for email: recipient, subject, preview). What runs is exactly what you approved — the agent can't swap in different details after you tap Approve.
Same approval for every app, and every action is logged: which bot asked, what action, the risk level, who approved or denied, and when.
Made and maintained by aiSecurityWarden. Turn one on for a project with a switch — they don't count against your plan's custom-connector limit.
For any application we don't cover yet — internal tools, a niche API, a home automation system.
Our connector toolkit creates a ready-made starter project with instructions written for AI coding assistants. Tell your assistant what the app does and which actions it should offer; it writes the connector, marks each action's risk level, and runs our built-in checker. Pack it into a single file, upload it, and turn it on. Every action goes through the same approval rules as our built-in connectors.
You don't write any approval logic. You describe the action; aiSecurityWarden handles asking, waiting, approving and logging.
A testing kit is included — test without touching the real application.
Because the AI must mark each action's risk, and high risk always means one-at-a-time approval, a careless connector still can't let an agent send or delete freely.
Apps with their own official AI connector (MCP servers): aiSecurityWarden will sit in front of those too, same rules, no connector to write Coming soon
Your secrets are encrypted in your browser before they're sent, and we only store data we can't read. But a web page runs code delivered by the website, so you are trusting that code.
The same encryption, done entirely on your computer, without relying on code served by our site. If you'd rather not rely on the website at all, use the desktop client. We'd rather tell you this than have you find out later.
Questions about plans, a team or company rollout, a connector you need, privacy, or a security report — send us a note and a person will answer.
Please never send secrets, passwords or tokens in this form.