Your agents can only ask.
A Crisper agent can read what you've let it read. To send an email, change something in one of your tools or spend money, it writes a proposal and waits. You approve it, and our code does the sending, never the agent.
A morning, as Crisper saw it
Support reads Maya's message in IntercomAllowedSupport drafts a reply to MayaWaits for youSupport tries to open Google AdsNot granted
Ads wants to pause a campaignWaits for youOne call, start to finish
Agents don't connect to your tools. Every call goes through Crisper first, and Crisper is the only part that holds a key.
Names the tool and what it wants
All it has is a name for the tool. There's no key in its prompt, its logs or the machine it runs on.
Authorization: Bearer {{INTERCOM_KEY}}
Checks it, in code
- This agent was granted this tool
- The grant covers this operation, and this domain or ad account if it names any
- It's a read, so it goes through
- It's a change, so it stops here and becomes a proposal for you
Gets the request with your key
Crisper adds the key on the way out. The answer goes back to the agent, the key doesn't, and the call goes on the record.
Authorization: Bearer ••••••••••••
The rules
Your keys stay in the Crisper Vault
Keys and sign-ins are encrypted with AES-256-GCM, using a separate data key for each workspace. Once saved, a key is never shown again, to you or to anyone. Disconnect a tool and its key goes with it.
Only what you allow
A new agent reaches none of your tools. You grant it one at a time and pick what it may do there, down to the domains or ad accounts. Support can answer customers and still have no way into your ads.
You approve the exact thing that runs
A proposal shows the words or the change in full, and it can't be edited after it's made. Approve it on the web, in the phone app or in Slack. Only owners and admins can. Two people tapping at once still runs it once.
Passes that expire
A task agent runs inside Crisper and holds no credential at all. An agent running as a Claude routine gets a pass for one agent and one job. It lasts two hours at most and stops a few minutes after the job ends.
Everything on the record
Who did what, when, and who approved it. The log can only be added to, and each row is hashed to the one before, so a changed row breaks the chain. Keys and message text stay out of it. Workspace owners can export it as a CSV.
Letting go is your call
Outreach is the one place an agent can act on its own, and it's off by default. An owner can turn it on once a person has decided 20 of the agent's emails and rejected under 10% of them. Each email then waits 10 minutes, and a comment on the case stops it.
What if
We assume things go wrong. Models get fooled and they make things up, so nothing here depends on the agent behaving.
A customer's email tells the agent to ignore its instructions
What customers and tools write reaches the agent marked as their words, not yours. We can't promise a model is never fooled. If it is, it can still read only what you granted and open public web pages. Anything it wants to send or change is a proposal you can read and reject.
The agent writes something wrong
You see it before the customer does. Reject it with a note and the agent hears why.
An agent's pass leaks
It's no use for another agent, it has no key in it, and it expires. Whoever holds it can only do what that agent could, so changes still wait for you.
Someone copies our database
Your keys are unreadable without the master key, which isn't kept in the database. That extra layer covers keys only. Cases and messages rely on our database provider's encryption at rest.
You want to know why something happened
Open the case. It shows what started the run, what the agent read and proposed, who approved it, and what ran.
For your security review
- Hosting and data
- The app runs on Cloudflare. Data is in Postgres on Supabase.
- Sign-in and roles
- Google or an email link, so we hold no passwords. Owners and admins change things and approve. Members see and chat.
- AI models
- Anthropic or DeepSeek, or Claude through your own account for a routine. They get the part of the case the agent is working on, and your data isn't used to train them.
- Reads without approval
- Reads from tools you granted, web searches through Exa and public web pages. For an MCP server, you can make reads wait for approval too.
- Allow-lists
- An API that only answers known addresses can get requests from one fixed IP. Tick the box when you connect it.
- Your data
- Ask us for a copy, or to delete it. The full list of who processes what is in the privacy policy.
Found a problem, or have a questionnaire?
Email apoorv@crisper.ai. It goes straight to the founder.