Security
Built so even we can't use your keys.
Hewy holds the keys to your servers, so it's built so that nobody else can use them, us included.
Who can see what
Your devices hold everything. Our server holds only what your devices sealed first, and nothing it could use.
| What | Your devices | Your servers | Hewy's server | The AI provider you chose |
|---|---|---|---|---|
| Your servers' names and addresses | ||||
| Saved passwords | ||||
| API keysEach server gets only the keys you give it | ||||
| Your devices' SSH private keysMade in your device's secure hardware, never synced | ||||
| Your Terminal sessionsBetween your device and your server only | ||||
| Files on your serversOnly what an agent reads when you ask it to work there goes to its provider | ||||
| Your chats with agentsThe provider gets what the agent sends it | ||||
| Pages you let an agent readOnly what's visible on the page, never what's in password fields | ||||
| Your master password | ||||
| Your email address |
- Can read it
- Holds it encrypted, without the key
- Never gets it
Your devices talk to your servers directly
Nothing about your work passes through us.
Straight over SSH
Your devices connect straight to your servers over SSH. Your terminal sessions, files and conversations with agents never pass through our servers.
Server identities are remembered
The first time you connect, you check the server's identity and Hewy pins it. If it ever changes, Hewy stops before sending a password or signing anything.
Sync we can't read
Your servers, saved passwords and API keys follow you between devices, sealed before they leave each one.
Your master password never leaves your device
Your device turns it into two keys: one proves it's you to our server, and the other unlocks your data. We only ever store a fingerprint of the first, and never see the second.
Everything you sync is encrypted on your device first
Your servers, their identities, saved passwords and API keys. Our server stores scrambled data it has no key for, padded so that even sizes reveal little.
Every change is signed
By the device that made it, and chained to the change before it. If our server, or anyone who broke into it, altered, reordered or rewound your data, your devices would notice and refuse it.
Adding a device
Sign in with your password, or scan a QR code shown on the new device with one that's already signed in. The QR code goes straight from one screen to the other camera, so the server can't intercept it.
A recovery code, if you make one
It's shown once and never stored on your devices. It gets you back in if you forget your password and lose every device.
Removing a lost device
It's signed out for good, and your account's encryption key changes, so it can't read anything synced after that.
Keys that stay put
A key that can't be copied can't be stolen from a backup, a sync or us.
Each device makes its own SSH key
It lives in the device's secure hardware, the Secure Enclave on Apple devices and the Android Keystore on Android, and can never be copied off. Private keys never sync.
Adding keys can't lock you out
When you add keys to a server, Hewy backs up the file first and refuses changes that would lock you out, unless you confirm.
Agents on your servers
Agents work on your servers, and ask before they act. Your answer is yours alone to give.
Signed approvals
When you approve something, your device signs exactly what the agent asked to do, using a key that needs Face ID, Touch ID or your passcode. Once one of your devices has connected to a server, the Hewy Daemon there won't accept an approval that isn't signed, has expired, or was already used.
A sandbox
On Linux, agents run in a sandbox that keeps them away from the daemon and its settings, and stops them changing your shell startup files or SSH configuration, while still letting them work on your files. Reading a file usually doesn't need your approval, so an agent can read anything your account on that server can, including keys stored there: turn on "Hide SSH keys from agents" where that matters.
Your server's SSH keys
Agents can use the server account's SSH keys, as you would there, so Git and deploys over SSH keep working. Turn on "Hide SSH keys from agents" for any server where an agent shouldn't be able to reach your other machines.
Connections between chats
No agent can message another until you connect their two chats, and you choose the direction, what may travel and for how long. A message from another chat reaches the agent marked as from an agent, not from you, so it can't approve anything, and each chat's own approvals still apply. Files are read by the sending agent's own tools, inside its sandbox on Linux, so it can only send what it could read anyway. Your own devices carry the messages, and servers never connect to each other. If you turn on relaying for a connection, messages can also wait on hewy.app while no device of yours is open, sealed so we can't read them.
Encrypted notifications
The text is encrypted on your server for your devices. Apple and our push service only ever carry ciphertext and a generic "Open Hewy" message.
Signed releases
Every release of the daemon is signed with a release key kept offline, never on our build machine, and Hewy checks that signature and the checksums before installing it on a server. The daemon never opens a network port.
Your own API keys
Each server keeps them in a file only your account there can read. Claude and Codex receive only the keys for their own provider. OpenCode, which can use many providers, receives the keys you've added for it. A key only ever goes to its own provider.
Agents in your browser
An agent can read and use pages beside its chat. The rules that keep it safe are enforced by the Hewy app on your device, so a page that tries to talk the agent into something can't get around them.
It's your browser, on your device
The agent's server never gets a browser of its own. The agent asks the Hewy app on your device, over your own SSH connection, and the app decides. Close the app, and the agent can't use it.
You give access, site by site
For each chat and each site, you choose Off, Can look or Can drive. Can look lets the agent read the page and take screenshots; Can drive lets it click, type and choose. Stop is always on the page.
Hewy asks before anything that matters
Before the agent presses a button to buy, pay, place an order, subscribe, send, post, delete or move money, or submits a payment form, Hewy shows you what it's about to do and where, and waits for your yes. The check runs in the app, on the button the agent actually aimed at, so the agent can't skip it.
"Allow and Don't Ask Again" lasts for that site only until you close the tab. Payment forms always ask.
It reads only what you can see
Pages can hide text meant for the agent, not for you: "ignore your instructions and…". Hewy leaves out anything hidden, invisible, tiny or off the page before the agent reads it, and tells the agent it did. Everything a page says reaches the agent marked as coming from the page, not from you.
Your passwords stay yours
You sign in yourself. The agent never sees what's in a password field, and Hewy won't let it type passwords, one-time codes or card numbers. When a page needs one, the agent asks you to type it in.
"Any site" isn't every site
You can let a chat drive any site it goes to. That never covers banks, email or password managers: you allow those one by one, yourself. And on those sites, Hewy asks before the agent submits any form.
The trade-offs, and known limits
Nobody can reset your master password
Anyone who knows your master password can sign in as you, so use a long passphrase and keep it in a password manager. Nobody, including us, can reset it. A recovery code, if you make one, is the way back in.
Known limits
- On Macs, agents run without a sandbox, by design: Xcode and Swift builds use Apple's own sandbox, which can't run inside another one.
- An outside security review is planned before the App Store launch.
- Hewy spots the buttons that matter by their words and by payment fields, and banks, email and password managers by a list. A button with an unusual name, or a site that isn't on the list, can get past those checks, so give Can drive only where you'd trust the agent.
- Web approvals aren't signed like command approvals: the app does the clicking itself, so the app is the check.
- Web control is new. The outside review will cover it too.
Found a security problem?
Email support@hewy.ai, and please don't share it publicly until it's fixed.
Your keys stay home.
Try Hewy free for 14 days, then US$99 a year or US$9.99 a month. No Hewy account needed to start.
Get it forAndroidMacComing soon foriPhoneRead the privacy policy →