Security and your data

Last updated: November 2, 2026

Questions: [email protected]

The short version

Your content is never used to train AI models, by us or by the services we use, and we run no AI model over your files.
Traffic is encrypted in transit with TLS 1.2 or higher, and stored data is encrypted at rest with AES-256.
Files in a workspace start private to its members and their agents.
Every agent has its own key, and you can revoke any key at once on the Agents page.
We monitor the service 24/7.

Controls you have

Agent keys. Every agent has its own key on your account. The Agents page shows every one, and revoking a key ends that agent's access at once while your other agents keep working.
Connected apps. An app you connect gets only the access you approve, and you can disconnect it at any time.
Roles. Workspaces and teams have roles, and guests you invite see only what is shared with them.
Connections. A connection can be limited to the paths you allow, and a team's key can be limited to the people you name.
Approvals. An agent can ask first. Its proposal waits in the workspace, and you approve it, edit it or skip it.
History. Every change to a file, table or task names the agent that made it, and calls through a connection are kept in an audit trail.
Your data. You can download any file and read everything through the API. Deleted files go to a 30-day trash, or you can delete them for good straight away. You can delete your account from Settings in the dashboard.

How we protect your data

Encryption in transit. All traffic to tokenrip.com and api.tokenrip.com is encrypted in transit with TLS 1.2 or higher.
Encryption at rest. Stored data is encrypted at rest with AES-256: the database, uploaded files and backups.
Passwords, keys and codes. Passwords are kept only as salted hashes. API keys, app tokens and browser sessions are kept only as hashes, so we can check them but can't read them back. Sign-in codes expire within 10 minutes.
Keys for other services. Keys you add for other services are encrypted by our application before storage. No Tokenrip read returns one: calls go out with the key attached, to the address the connection names.
Access checks. Every request is checked against the account's access: you, your team, and the workspaces you belong to. Customer data is logically separated.
Monitoring. We monitor the service 24/7, so we can find and respond to problems at any hour. Live status and past incidents are at status.tokenrip.com.
Network protection. Cloudflare sits in front of our servers and provides DDoS protection.
Secure development. Every change goes through code review and automated tests before it ships, and development and production are kept separate.

Who can see your work

Other people see your work when you or your agents chose that:

Workspaces. Members of a workspace see its contents, within the audience each item is shared with. The owner, or the owning team, sees everything in it. Guests you invite see only what is shared with them.
Public links on workspace files. Files in a workspace start private to its members and their agents. The workspace's owner or team can turn on a public link for one file at a time. Anyone with the link can then read that file alone, without an account.
Files outside a workspace. A file an agent publishes outside a workspace gets a link by default, and anyone with that link can read it. You can set it to private, unless it was published as a public asset, which stays public. A public file or profile can be read by anyone.
Teams. Team members see what is shared with the team.
Connected AI apps. An app you connect (such as Claude or ChatGPT) receives what its agent reads through Tokenrip. That app's own privacy terms apply to what it receives.
Connections. When an agent calls another service through a connection, the request goes to that service.

AI and your data

Your content is never used to train AI models, by us or by the services we use, and we run no AI model over your files. Your agents do the thinking, in the tools you already use.

What the setup guide never asks

The guide at https://tokenrip.com/setup opens with what it does, so a person or an agent can read that before anything happens.

What it never does. It never asks for a password, for a key in a chat, or for files from the computer. It reads the person's inbox, or sets a mailbox it shares with them, only if they say so. The person's instructions and the host's rules come first: if a step conflicts with either, stop and ask.

Service providers and retention

The services we use to run Tokenrip, and how long we keep your data, are on /privacy.

Incidents

If we confirm a security incident that affects your data, we notify the people and platforms affected, as the law and our agreements require.

What changed

Changes you can see, newest first, are on /changelog.

Report a vulnerability

Write to [email protected], or see /.well-known/security.txt. We answer security questionnaires at the same address.