Security

Control access to your personal context and see the evidence behind it.

Choose what crosses

  • Review the scopes and records an agent may read
  • Keep access bounded by an expiry
  • End a connection when its work is done

Deny by default

  • An agent needs your approved access
  • Suggestions wait for your decision
  • Rules guide behavior; grants enforce context access

Storage you choose

  • Online workspaces use encrypted account storage
  • Optional local workspaces stay on your computer
  • No analytics or automatic upload of local records

The controls

ControlWhat it does
1Passkey sign-inAccount
  • Your device confirms membership with a passkey
  • Your fingerprint, face and screen lock stay on your device
2Scoped context accessAgents
  • You choose context scopes and can select individual records
  • Required rules accompany context reads; selected-record access excludes future non-rule records
3Expiry and revocationAgents
  • Each connection has an expiry and an End access control
  • Online agent access continues after sign-out; ending access stops future requests
4Encryption at restWorkspace
  • Personal content is encrypted with a separate key for each workspace
  • The hosted service can decrypt approved context; this is not end-to-end encryption
5Verifiable access historyWatchtower
  • Context access and workspace changes join a hash chain
  • Browser receipts compare the sequence and hash with previously observed history
6Owner-approved memoriesRecords
  • Imports, agent suggestions and submitted Squot lessons wait for review
  • You can edit, accept, replace or dismiss proposed knowledge
7Explicit data controlsSettings
  • Export and import are explicit choices; existing local data is not uploaded automatically
  • Workspace erasure ends its agent access; provider copies remain outside Castellan
8Optional request checksSettings
  • You can check request wording and scopes for suspicious patterns
  • This advisory check does not grant access or automatically screen every connected-agent call
9Attributed action reportsWatchtower
  • External actions appear only when an authorized agent reports them
  • Reports and alerts do not verify, authorize or block external execution
10Squot execution consentSquots
  • Record recall uses no model call; hosted writing and planning require explicit consent
  • Selected context and required rules go to Cloudflare Workers AI; Squots have no external-action tools

Where each control applies

You decidepasskey sign-in,optional request checks18Your recordsencrypted account storage,review and data controls467Your Squotselected context,explicit hosted consent10Connected agentapproved scopes and records,expiry and End access23Context brokerauthenticates access,serves approved contextWatchtowerverified access history,agent-reported actions59 You decidepasskey sign-in,optional request checks18Your recordsencrypted account storage,review and data controls467Your Squotselected context,explicit hosted consent10Connected agentapproved scopes and records,expiry and End access23Context brokerauthenticates access,serves approved contextWatchtowerverified access history,agent-reported actions59

Context access and external work

Castellan enforces the context a connection can retrieve. Standing rules travel with that context. A provider controls what its agent does with received copies and in its other tools. Ending access prevents future requests through Castellan; it does not delete copies already received.

What Watchtower can show

Context access is logged automatically. External actions depend on agent reports and are labelled as reported. Check the service itself for an independent execution result. Alerts draw attention to reported sensitive activity; they are not transaction approval gates.

Not an AI gateway

Connected agents talk to their model providers directly. Castellan supplies authorized personal context, accepts suggestions and records attributed action reports. Its own optional Squot jobs run separately from your connected agents.

Connected agent
Castellan
Chooses its model and tools
Controls access to your context
Works in external services
Reviews proposed memories with you
Reports its external actions
Shows the report and reporting coverage

Check it yourself

Open Watchtower for context and access history, reporting coverage and agent-supplied outcomes. Review the storage and transfer details before sharing personal context.

Read the privacy policy

Read the threat model on GitHub

The separate developer runtime

Developers can run the local socket broker, credential vault and additional Guardian controls from the repository. Those controls belong to that runtime; they are separate from the browser workspace and its optional Mac and Windows packages.

Found a hole?

Write to contactus@castellan.us.

Your five rooms

Overview shows your next step. Records keeps approved context. Agents manages connections, with the Gatehouse for approving or refusing access. Watchtower shows the evidence. Settings holds your account and security choices.

Explore the rooms and the approval flow