AgentTask runs agents on hardware you own, so it was built to need as little trust as possible. Here is how, in plain terms, and where to tell us when something is wrong.
Design decisions, not promises. Each one is in the code, and the code is open source.
Claude Code, Codex and Grok sign in on your machines and stay signed in there. AgentTask reads liveness, quota and usage from the daemon, never the login itself. There is no vault of your agent keys on our side to leak.
One binary per machine. An update is only installed when its sha256 matches and its ed25519 signature verifies, then swapped in atomically and restarted by launchd or systemd.
The installer checks the same signature with agenttask verify-signature, against the release key compiled into the binary.
Many organisations share one core, so the line between them is not left to application code alone. Composite foreign keys carry the organisation into every reference, so a row can never point at a row in another organisation, whatever the application code does.
Every change, from a person, an agent, the API or MCP, goes through one mutation bus that writes one sequenced event. There is no side door that changes data without leaving a trace.
Pair a machine as a team machine or a private one. Activity on a private machine syncs only to its owner and members, not to the rest of the organisation.
Outgoing webhooks are signed, so your receiver can prove a call came from AgentTask. A guard stops a webhook URL from being used to reach internal addresses.
Pick what fits the person, or the terminal.
Found something? Tell us privately first, so it gets fixed before it gets used.
Include what you found, how to reproduce it and what an attacker could do with it. Please do not test against other people's organisations or data.
Security addresssecurity@agenttask.ioNo certifications to show yet, and we will not pretend otherwise. What we can show is the code: open source, with the license announced at the first public release.