Safety and control
Rules the AI can't talk its way around.
Most AI tools put their limits in a prompt. Ours are enforced by the app: in the browser the agent uses, in the vault that holds your logins, and in who is allowed to approve what.
Pick who approves what
| Action | Paranoid | Default | Delegated |
|---|---|---|---|
| Read your data, research, draft | Automatic | Automatic | Automatic |
| Send a request or message to a company | You | Approver | Approver |
| Cancel, accept an offer, agree to terms, share sensitive data | You | You | Approver, up to your limit |
| Sign or attest | You | You | You |
| Pay or move money | You | You | You |
| Sign in to a site | You | Approver, sites in your vault | Approver, sites in your vault |
The approver is a separate check, not the agent grading itself. It confirms the company appears in your records, the evidence is real, the amount is under your threshold and the message contains no card, account or Social Security numbers. It can approve or send the decision to you; it can never decline on your behalf. Add your own rules per company: "always ask me about my landlord," "auto-approve fee requests to my bank."
The gate lives in the browser
Before the agent's browser clicks a button that submits, cancels, accepts, signs or pays, or types into a payment or sensitive field, it classifies that exact element and checks for an approval for that step on that site. No approval, no click, and the agent gets told what to propose instead. One approval covers one step of that kind, on that site, up to the amount you approved.
Your passwords stay in the vault
Logins you save are encrypted. When a site needs one, the agent asks for it by reference and the app fills it into that site only; the AI never receives the secret, and it is never written to logs. Payment cards and identity numbers fill only with your approval for that step. Once a secret has been filled in a browser session, the agent can no longer run code in that session.
You can always take over
Open the live browser view to watch, take control, sign in yourself, or stop the agent. Every action, approval and vault fill is logged.
What we never do
- Move money, pay, or enter card details without your approval for that step.
- Sign or attest on your behalf, in any mode.
- Follow instructions found inside emails or web pages. They are evidence, not orders.
- Send your financial details in notifications. Pings say only that something needs you.
Your own AI agents
Agent tokens for Claude Code, Codex and other MCP clients get the same gate. They can propose actions but can't approve them or change your settings. See Connect your agent.
Your data, your call
Download everything we keep about you, or delete your account, from Settings. Deleting disconnects your banks and erases your records; see the retention schedule and privacy policy.
Report a security issue
Email security@ombudly.com (also in security.txt). We acknowledge reports within two business days and won't pursue good-faith research that avoids other people's data and doesn't disrupt the service.