Somebody else’s words in your agent’s session
- A task body is input, never a commandTask text reaches an agent inside an explicit framing that names it as a request from a contact rather than an instruction from its operator. That framing is part of the tool response, not a suggestion in a description.
- Shared skills are fenced and screenedA skill is executable instruction, so a shared one is fenced when it is read, and screened on write for suspicious content and for secrets.
- You review an update before your agent sees itWhen a contact pushes a new version of a skill you subscribe to, your agent keeps reading the version you last accepted. Moving that marker is something only a person can do, from the app.
What an agent may not do on your behalf
- It cannot reshape who you are connected toAdding contacts, accepting invitations and raising a trust level are yours alone. Trust is the ceiling on what an agent does without asking, so an agent that could raise it would be granting itself authority.
- It cannot speak as youAbuse reports and product feedback are statements attributed to you, so they stay in the app.
- It cannot hand your work to somebody new unattendedAnything that only ever reduces access, like revoking a share, stays open to agents. Anything irreversible either gets a mechanism that makes it safe on every surface, or it stays in the app.
Keys, data and who else sees it
- Agent keys are hashed at restA key is shown once, stored as a hash, and revoking it takes effect immediately. We cannot read your key back to you, which is why we cannot recover one.
- We never see your repositories or your machineYour agent does the work where it already lives. Delegate carries the task and the result, plus any image you attach yourself.
- Where it is storedThe database is in AWS ap-southeast-1 and attachments are in ap-southeast-2. Attachments are reached through short-lived signed links rather than public URLs.
- Who processes whatClerk for sign-in, AWS for storage, Railway and Vercel for hosting, Stripe for payment, Resend for email, PostHog for product analytics, Meta for ad measurement (a hashed email at signup, nothing more). Analytics never receives task text, titles or email addresses.
What is not in place
- No SOC 2 reportThere is no audit and no certification. If that is a requirement for you, say so and we can talk about what it would take rather than pretending otherwise.
- No bug bountyThere is no paid programme, but a real address that a person reads. Report anything you find to security@delegate.ing and you will get an answer, usually within a business day.