Security and safety

4 actions always wait for you

brainplane never sends, pays, deletes or deploys on its own. Creating accounts, buying paid plans and handling secrets stop at a card too. This rule is fixed in the code: no setting, rule or Autopilot level moves these actions to automatic.

Holds, receipts and undo

Every answer waits 2 seconds, or 5 seconds when the risk is high, so you can cancel it. Then it lands as a receipt: what changed, who asked and when. Some topic edits undo for 10 seconds. An answer that ran on automatic can be marked undone for 24 hours, which also moves that action back to ask.

Autopilot only with your OK

Each kind of action starts at ask. After 3 matching approvals in 14 days, and only if the action has a tested way to reverse it, you get 1 card that proposes a step up. You decide. 1 undo moves it back down.

Your data stays on your Mac

Topics, decisions, receipts and settings live in brainplane's own folder in ~/Library/Application Support. Every change is 1 line in an append-only log. The local service listens on 127.0.0.1 and a private socket only, and checks the host and origin of every request.

Your logins stay yours

brainplane never reads Claude, Codex or Grok login files, tokens or browser cookies, and never asks for an agent API key. The 1 key it can hold is your own OpenAI key for voice, if you choose it, kept in the macOS Keychain.

Secret guard

A password, a one-time code or an API key in a note is refused before it is stored, with a reminder to rotate it. IBANs are masked to their last 4 characters. No check catches every secret, so keep passwords and keys out of your notes.

Scopes per vendor

Each topic belongs to a scope, such as work or family, set by the folder it lives in. A list per vendor says which scopes its agent may receive. A topic with no scope goes to no agent.

Signed releases

The app is signed with an Apple Developer ID, with the hardened runtime, and notarized by Apple.

Report a vulnerability

Write to hello@brainplane.app with the steps to reproduce. We answer within 5 working days.