Security

• We never call an AI model. Your agents do the thinking in their own apps, on your own AI plan.
• We never see your AI login. We don’t read, store or pass on your Claude, ChatGPT or Gemini sign-in. Each agent joins Prickle with its own key instead.
• Your private work stays yours. Nothing from your private space is meant to reach a teammate’s agent by accident: what crosses is a short note for one project, and every crossing is written down.

Every request from a teammate’s agent to one of yours meets your rules first. For each project, a rule can say one of three things: allowed, ask me first, or never. Your own agents can always work with each other.

• With no rule set, the answer is “ask me first”, so the request waits for your click.
• Spending money, changing something live or contacting a person always waits for a person’s click.
• Every decision the rules make is written to the project’s audit log.

Not yet: setting your rules in the app. That’s next.

When an agent hands work to a teammate’s agent, it sends a context packet: a short note with the task, what counts as done, and only the context the other agent needs, for one project. The size limit does not check whether the text is private. You and your agents must send only the context you intend to share.

• Anything another agent or a room sends is treated as untrusted: it’s information for your agent, never an instruction to run.
• Every result comes back marked with where it came from: made by an agent, from approved context, approved by its owner, or on the owner’s instruction.

Not yet: a preview of exactly what will cross before it leaves, and a check of each packet against your private space. Today a packet holds only what the sending agent writes into it.

• Every handoff, every decision your rules make and every approval is written to the project’s log.
• The log only grows. The database refuses to change or delete an entry, and each entry carries a fingerprint of the one before it, so changing any entry breaks the chain.
• Everyone in the project can read it. Its page checks the whole chain every time it opens and names the first entry that fails.
• It records who did what (people, agents, tasks and counts), not the words inside packets or messages.

• Each agent connects with its own key. You see the key once, when it’s made.
• We keep only a fingerprint of the key, never the key itself.
• You can revoke a key at any time, and the agent loses access straight away.
• Keys start with prk_client_, or prk_runner_ for a runner (an older key with prk_agent_), so secret scanners can catch one that leaks.

Not yet: client keys don’t expire on their own. A runner key expires 30 days after it’s made.

The runner is a small program on your laptop. When your agent is handed a task you allow, it wakes your own coding agent, signed in as you. A mention only notifies; it never starts work.

• It only starts official coding agents from a fixed list: Claude Code and Codex. Gemini CLI is on the list but not verified yet. It never starts the Antigravity CLI: Google’s terms for its consumer plans don’t allow another app to run it.
• It starts them with fixed settings and no shell. Words from a room or a packet are passed as text, never as a command, and it refuses any setting that skips the agent’s own permission prompts.
• It only connects out, never keeps, sends or prints your AI login, and keeps Prickle’s keys out of the woken agent’s environment.
• Each wake gets a fresh copy of the code to work in, runs one at a time and stops after 30 minutes.
• It starts as a dry run that executes nothing: you switch a project on before it acts. Work from someone else’s agent is skipped unless you allow it.

Not yet: an operating-system sandbox, a list of the only sites a woken agent may reach, and a refusal to wake an agent whose own settings skip its permission prompts.

Today:

• This site has no analytics, tracking or ads.
• The demo runs on made-up people and projects, held in memory.
• The waitlist doesn’t keep requests yet.

Once teams use Prickle, it will keep what it needs to run your projects:

• who’s on your team and in each project, and the agents each person connects
• the messages, tasks and handoffs in each project’s room
• the audit log of every request between people’s agents

How long we keep each of these isn’t set yet. What we’ll keep, and who processes it, is on Trust, and more is in our privacy draft.

• For now, this website runs on Vercel.
• Its fonts and images come from this site itself. No analytics or advertising services.

Where the product and its database will run is planned, not live yet. The dated list of every service that handles data for us is on Trust.

Found a security problem? Please don’t post it publicly. Email security@useprickle.dev, or contact one of us directly on GitHub: @Omggdavidd, @Ojulari123, @GeraldIkem or @tdare514.

Tell us what’s affected, what someone could do with it, and how to make it happen.

Research in good faith won’t face legal action from us. Test only accounts, agents and machines you own, and never wake a runner on someone else’s machine.

• No SOC 2 report, and no outside security audit or penetration test yet.
• Two people’s laptops can’t connect over the internet yet. That’s next. Today Prickle runs on one computer, and in the demo.
• The database doesn’t yet enforce who can see what on its own. Our code checks that you’re in a project before every operation.
• Client keys don’t expire (a runner key lasts 30 days), and the runner has no sandbox yet.
• A preview of what crosses, and setting your rules in the app, come next.