Enterprise security

Keys stay private. Business data stays local-first.

Multi-model and multi-Agent collaboration needs shared context, stronger permissions, and secret governance. LoneAct keeps model keys, local environment variables, your devices, data scope, and audit evidence in one security chain.

Centrally managed provider keys

Provider keys are held in secure platform storage. Frontends, API responses, and diagnostic logs never return plaintext; the interface shows only status and fingerprints.

Local keys never reach the model

Environment variables and mounted files are held by host secure storage. Enabled values are injected into the execution process; the model sees references, not plaintext.

Roles and permissions

Admin APIs verify administrator identity and role independently; normal user sessions do not carry administrative permissions.

Controlled execution scope

Local mode only exposes the project folders you authorise to Agents. Remote access requires explicit, revocable permission.

Data stays on your devices

Project files, conversations, run records, and Agent memory stay on your computer. The cloud account service keeps only account, access, and necessary audit metadata.

Audit and traceability

Key admin actions, request usage, and tool calls are recorded separately for security review and troubleshooting.

Security control surface

Security is not a document.
It is the state of the workspace.

Keys, access, execution boundaries, data locations, and audit are visible in the project workspace. Users do not leave the task to guess their permissions, and logs or interfaces never show plaintext keys.

Provider keys and local keys appear as status or references; new values are entered once and never shown again.
Each project exposes only approved directories; remote access is managed through permissions.
In local mode, projects, conversations, and Agent memory stay on your computer and are not uploaded as cloud business data.
Approvals, tool calls, and key configuration changes enter the audit trail for review and traceability.

Keys & permissions Project scope

Provider credentialscentral vault · fingerprint only

protected

Project accessowner + 1 approved devices

Access

Audit events24 recorded · latest 2m ago

tracked

Execution boundary

Tools run only inside authorized project directories. Remote access is scoped, visible and revocable.

Security governance

One chain from keys to execution

Provider keys never reach the client

Models reference provider connections by connection ID. Requests carry activation codes, never upstream keys.

Shared Agent context, separate permissions

Collaborating roles share task context, while tool and project-folder access remain constrained by authorization and session policy.

Execution location is visible

Local, browser, and cloud entry points are labeled separately. When terminal or browser actions are involved, location and permission prompts stay visible.

Minimal logging

Usage and diagnostic logs support billing and troubleshooting. Sensitive fields are minimized, and retention is configured by the deployer.

Read security docs View plans

Need an enterprise security review?

For procurement, private deployment, or security assessment, contact the site operator for deployment and data-processing details.