trust
Full privacy docs
Trust & privacy

Where your data is, at every step.

OneHuman runs inside your own server. The decision about what an AI agent may see is made next to your data and never leaves it. This page is for the security and legal reviewer: what stays, what leaves when you choose to send it, and what is never collected — by construction, not by policy.

Stays on your server

  • Every decision, with its evidence and reasons
  • The hash-chained audit log
  • The signed proof of each decision, and the private key that signs it
  • Session records and their agent/human state
  • Passkey credentials your users register
  • Your policy file and your mask functions

Leaves only if you add an API key

  • A one-way digest of the session id (never the id)
  • Resource name, decision, actor, session state
  • Detected agent product names and reason codes
  • Enforcement mode and engine version
  • The signed proof — the same fields, signed
  • Your rules (the policy file), so the portal can keep, version and sign them
  • The names you pass to protect(), e.g. balance.read, so the portal can show parts without a rule
  • Which rules version runs, and whether it came from the portal, the saved copy or the file
  • Nothing else. Remove the key and nothing leaves.

Never collected, anywhere

  • Request or response payloads
  • What the person typed — no keys, no characters, no form values
  • Page text or the content of what was displayed
  • Names, e-mails, account numbers, customer identities
  • IP addresses in reports
  • Cross-site identifiers or tracking fingerprints

Check it yourself: npx onehumanai inspect prints exactly what the page script sent in a session, from your own database — byte for byte when the server runs with ONEHUMAN_RECORD_RAW=1.

The page script measures how the session behaves — timing, movement geometry, known agent-tool traces — not what it contains. It is served from your origin and posts only to your origin.

The path of one decision

BrowserThe page script sends behavioural metadata to your server. Data already on screen is redacted the instant an agent appears.
→ your origin only
Your serverThe engine decides allow · mask · step up · block, writes the audit row, signs the proof. Your handler returns full or masked data.
→ opt-in, metadata
OneHuman portalWith an API key, a report of the decision (fields above) arrives in the background, batched, off the request path. It never blocks your response.

What the portal stores

Your account

  • Your e-mail address
  • A scrypt hash of your password — never the password
  • API keys as SHA-256 hashes; the raw key is shown once

Per API key

  • The decision metadata listed above
  • Your rules, every version, and who changed what and when
  • The public keys your server signs proofs with

Never, in the portal either

  • Your users' data, payloads or page content
  • Your server's secret or the private key that signs proofs
  • IP addresses of your users

Questions a reviewer asks

Where does OneHuman run?
As a library inside your Node process. Storage is your SQLite file or your libSQL database. There is no OneHuman component in the request path other than your own server.
Can we run it fully disconnected?
Yes. Without an API key no network call is ever made. Detection, policy, audit, proofs and passkey reclaim all work offline. Agent signature updates then arrive with package updates.
What is in the portal, and where is it hosted?
Aggregates and the decision log built from the metadata above, per API key, for your account only. The portal is hosted on Vercel with a Turso (libSQL) database. Sub-processors: Vercel (hosting), Turso (database), and OpenRouter only when you use the rules assistant. No advertising or analytics processors.
Where do the rules come from, and can someone change them in transit?
With an API key, your rules live in the portal: the file in your code becomes version 1 on first start, and later edits go there too. The portal signs each version (Ed25519) for your key only. Your server accepts nothing unsigned or altered, pins the portal's key the first time it sees it, and keeps the last signed copy — so if the portal is down, protection keeps running. Changes that lower protection or affect real people wait for your approval and your password.
Does the rules assistant see our data?
No. The assistant on the Rules page is used only when you type into it. It receives your message and your rules — names, labels and settings — and sends them to an AI model through OpenRouter. It never receives traffic, sessions, users or keys, and it can only change the rules you already have; you review every change before it is saved.
How long is telemetry kept?
Until you revoke and delete the API key, which removes its reported decisions. Revoked keys can be deleted at any time from the portal.
What does onehuman.ai log about visitors to this website?
This site (not your app, and not the package) keeps a visit log for its operators: the page or demo action, the time, browser and OS family, phone or not, the country and city our host reports, and a keyed hash of IP address + browser so repeat visits count once. No raw IP address, no raw user agent, no tracking cookie. Kept 90 days; demo rooms and their decisions 60 days.
Can our auditor verify a decision without trusting you?
Yes. Every decision is signed on your server with a key derived from your secret. The public key is served from your own site; the proof verifies with any standard JOSE library or npx onehumanai verify-proof. OneHuman the company is not in that loop.
What if OneHuman is slow or breaks?
Your app keeps working. OneHuman fails open: a protected request waits at most one second (you set it) for a decision; if the engine is slower or fails, the request goes on as if allowed, is logged as an unknown visitor and counted in the health endpoint. In observe mode this is always so. In enforce mode you may choose a 503 instead, per deployment. OneHuman's own routes answer their own errors and never reach your error handler.
Does the page script affect our users?
It is first-party, adds no third-party requests, sets one first-party cookie for the session, and changes nothing a person sees — except redacting sensitive fields the moment an agent attaches, which is the point.
Is behavioural data biometric?
OneHuman does not identify people and keeps no per-person template. It answers one question per session — is an agent operating it — from evidence of the session, and discards the raw movement stream. Nothing can be matched across users or across sites.
Security contact
Write to security@onehuman.ai (policy: SECURITY.md). Acknowledgement within 72 hours; a fix or mitigation plan within 14 days for confirmed issues.
Need a DPA, a sub-processor list on letterhead, or a security questionnaire filled in? Write to founders@onehuman.ai.