Security
Security and control
What always stops for you, what stays on your computer, and what we do not claim — including audits and SSO.
We do not claim an independent security audit, SOC 2 or ISO 27001 certification, or organisation SSO / SCIM — each will be listed when done, not before.
- Your IPWork and outputs stay yours.
- Device grantsFolders and accounts you revoke.
- Audit recordWhat ran stays with the task.
- GatesPayments and irreversible clicks wait.
Autonomy Dial in Carry Continuum keeps advise versus act split — FAR does not silently become Agent. Partial where labelled.
- AdviseFAR shows the plan. Nothing runs until you choose.
- AskConfirm gates before act. Irreversible clicks still wait.
- ActAgent carries the work. FAR stays a separate brain.
What PHRONEN always stops for
Payments and final clicks
Payment stops for you, and so does a click that submits, pays, sends or publishes when it is not covered by what you allowed.
Security checks
CAPTCHAs, passkeys and sign-ins are handed to you, never worked around.
Anything risky
Asks before anything risky, and never does what you ruled out.
Passwords and codes
Passwords, keys and sign-in codes are kept sealed on your computer and never shown in the conversation.
Real verification is yours: PHRONEN hands you the passkey, the CAPTCHA or the sign-in code, waits, and carries on once you've done it.
Permissions on your devices
- Grants on the device
What a device may reach is granted on that device and revocable from anywhere; a locked screen pauses the work.
- Device keys
Each enrolled device holds its own key, in the platform’s secure store where the OS offers one.
- Credentials stay sealed
Credentials are sealed on the device. Your account records what happened — never the files themselves.
- Independent check
Only an independent check can say it’s done — never the part that did the work alone.
Where your work lives
Your devices
Your files, screenshots taken during work, browser sessions, and what PHRONEN observed there.
Your account
Organisation, members and roles, trusted devices, tasks and evidence, standing work, credits, and the audit trail.
Outside services
Only what a step needs, when a step needs an outside service; those steps are marked as leaving the device.
In plain language
Only what you connect
PHRONEN uses the accounts you connect and the browser sessions you're already signed in to. Disconnect any of them at any time.
Every change can be undone
What a file held before PHRONEN changed it is kept on your computer, so any change can be put back.
Not used for training
Work from your organisation is not used for training.
Your company decides
An organisation sets what PHRONEN may do for its people: new-service accounts, which systems count as production (those always wait for approval), and who can approve.
Work uses plan credits through PHRONEN’s hosted gateway. Organisation members do not paste a provider key.
We do not claim
- An independent security audit of PHRONEN
- SOC 2 or ISO 27001 certification
- Single sign-on and user provisioning (SCIM) for organisations
Each will be listed here when it is done — not before.
Report a vulnerability
Found a problem?
Write to security@phronen.ai. Please test only accounts you own and do not access other people's data. We reply within one business day.