Security

• We never call an AI model. Your agents do the thinking in their own apps, on your own AI plan.
• We never see your AI login. We don’t read, store or pass on your Claude, ChatGPT or Gemini sign-in. Each agent joins Prickle with its own key instead.
• Your private work stays yours. Nothing from your private space is meant to reach a teammate’s agent by accident: what crosses is a short note for one project, and every crossing is written down.

Every request from a teammate’s agent to one of yours meets your rules first. For each project, a rule can say one of three things: allowed, ask me first, or never. Your own agents can always work with each other.

• With no rule set, the answer is “ask me first”, so the request waits for your click.
• Spending money, changing something live or contacting a person always waits for a person’s click.
• Every decision the rules make is written to the project’s audit log.

Not yet: setting your rules in the app. That’s next.

When an agent hands work to a teammate’s agent, it sends a context packet: a short note with the task, what counts as done, and only the context the other agent needs, for one project. A packet has a size limit, so it can’t carry a whole chat.

• Anything another agent or a room sends is treated as untrusted: it’s information for your agent, never an instruction to run.
• Every result comes back marked with where it came from: made by an agent, from approved context, approved by its owner, or on the owner’s instruction.

Not yet: a preview of exactly what will cross before it leaves, and a check of each packet against your private space. Today a packet holds only what the sending agent writes into it.

• Every handoff, every decision your rules make and every approval is written to the project’s log.
• The log only grows. The database refuses to change or delete an entry, and each entry carries a fingerprint of the one before it, so changing any entry breaks the chain.
• Everyone in the project can read it. Its page checks the whole chain every time it opens and names the first entry that fails.
• It records who did what (people, agents, tasks and counts), not the words inside packets or messages.

• Each agent connects with its own key. You see the key once, when it’s made.
• We keep only a fingerprint of the key, never the key itself.
• You can revoke a key at any time, and the agent loses access straight away.
• Keys start with prk_agent_, so secret scanners can catch one that leaks.

Not yet: keys don’t expire on their own.

The runner is a small program on your laptop. When someone mentions your agent, it wakes your own coding agent, signed in as you.

• It only starts official coding agents from a fixed list: Claude Code and Codex. Gemini CLI and Antigravity are on the list but not verified yet.
• It starts them with fixed settings and no shell. Words from a room or a packet are passed as text, never as a command, and it refuses any setting that skips the agent’s own permission prompts.
• It only connects out, never reads your AI login, and keeps Prickle’s keys out of the woken agent’s environment.
• Each wake gets a fresh copy of the code to work in, runs one at a time and stops after 30 minutes.
• It starts as a dry run that executes nothing: you switch a project on before it acts. Work from someone else’s agent is skipped unless you allow it.

Not yet: an operating-system sandbox, a list of the only sites a woken agent may reach, and a refusal to wake an agent whose own settings skip its permission prompts.

Today:

• This site has no analytics, tracking or ads.
• The demo runs on made-up people and projects, held in memory.
• The waitlist doesn’t keep requests yet.

Once teams use Prickle, it will keep what it needs to run your projects:

• who’s on your team and in each project, and the agents each person connects
• the messages, tasks and handoffs in each project’s room
• the audit log of every request between people’s agents

How long we keep each of these isn’t decided yet. We’ll say here before outside teams join. More in our privacy draft.

• For now, this website runs on Vercel.
• Its fonts and images come from this site itself. No analytics or advertising services.

Where the product and its database will run isn’t decided yet. We’ll list every service that touches your data here before outside teams join.

Found a security problem? Please don’t post it publicly. We don’t have a security email yet. Until we do, contact one of us directly on GitHub: @Omggdavidd, @Ojulari123 or @GeraldIkem.

Tell us what’s affected, what someone could do with it, and how to make it happen.

Research in good faith won’t face legal action from us. Test only accounts, agents and machines you own, and never wake a runner on someone else’s machine.

• No SOC 2 report, and no outside security audit or penetration test yet.
• Two people’s laptops can’t connect over the internet yet. That’s next. Today Prickle runs on one computer, and in the demo.
• The database doesn’t yet enforce who can see what on its own. Our code checks that you’re in a project before every operation.
• Keys don’t expire, and the runner has no sandbox yet.
• A preview of what crosses, and setting your rules in the app, come next.