Security

A narrow door,
by design.

An agent can send to one channel. It cannot look inside your inbox, see another channel, or manage your account. And when a channel is sealed, even Visti can't read what it stores.

Your agentyou approved it once

OAuth approvalsend only

Cloudflare storageencrypted at rest

Messageschannel log

Durable Object

Account & read staterecords + hashes

Imagesattachments

Sealed channelsciphertext only

your keys

Your devicesMac and web inbox

Encrypted, with the distinctions that matter.

“Encrypted” can mean four different things. Here is exactly what Visti does today.

In transitYes

TLS

Updates are encrypted while moving between agents, Visti, and your devices.

At restYes

AES-256

Cloudflare encrypts the storage underneath Visti and manages the keys. They are not device-only keys.

Sealed channelsYes

Device-only keys

Seal a channel and its content is encrypted to keys only your devices hold. What Visti stores is ciphertext it cannot read.

End-to-endNot yet

Sealed at the door

On a sealed channel Visti sees content only for the instant it seals it — never in storage. Agent-side encryption, where Visti never sees it at all, is next.

Sealed channels: a vault only your devices open.

The key is minted on your device, and what leaves your device is only ciphertext the server files away. Same inbox, same agents — Visti just can't read along.

What Visti storesciphertext

No title. No text. No sender, no urgency, no image — a sealed envelope plus the sequence number that keeps your read state in sync.

What your device showsdecrypted locally

Q4 report is ready M&A agent · now · Sealed Revenue closed at $4.2M — full breakdown attached.

Opened with the channel key from your vault — in the web inbox today, the Mac app next.

Turn it on in the web inbox → Sealed channels. Create a sealed channel (or seal one you own), hand the agent its usual key, and save your recovery key — it is the only way back in if you lose every device. Visti cannot reset it, which is exactly the point.

What protects the door.

Access is deliberately small, observable, and replaceable.

Send-only by default

An agent is granted sending by default. With your permission, it can also check responses to its own updates. That does not grant inbox access.

Raw credentials are not kept

Every credential is stored as a peppered hash — access tokens, device credentials, access keys and pairing codes alike.

Revoke one key

Each agent gets an independent key. Remove one without interrupting the rest, and see when it was last used.

Abuse has limits

Publishing is rate-limited. Pairing codes work once, expire after ten minutes, and are rate-limited too.

Where each thing lives.

Notification contentA per-channel Durable Object logTLS + AES-256 at rest · sealed channels: ciphertext only

Account and read stateCloudflare D1, with credential hashesTLS + AES-256-GCM at rest

Attached imagesCloudflare R2TLS + AES-256-GCM at rest · sealed channels: ciphertext only

Sealed-channel keysYour vault in D1 — private keys wrapped by your devicesOpaque to the server; only your devices unwrap them

Storage protections are documented by Cloudflare for Durable Objects, D1, R2, and SSL/TLS.

Today's boundaries.

Security is also knowing where the edges are.

Sealing is per channel and opt-in today. On regular channels Visti still processes content to validate, store, and deliver it — treat those as private, not secret.
Sealed is not yet end-to-end. Visti sees a sealed channel's content only for the instant it seals it at the door; nothing readable is ever stored. Agent-side encryption is the planned next step.
Lose every device and the recovery key, and sealed history is gone. Visti holds no spare key and cannot reset it — that is the guarantee working as intended.
The Mac app hasn't adopted sealed keys yet. Until it does, sealed updates appear there as “Encrypted update”; read them in the web inbox.
Images use shareable capability links. The URL is unguessable, but anyone who receives it can fetch the bytes — on a sealed channel those bytes are ciphertext that is useless without the key inside the sealed message. Uploads are limited to PNG, JPEG, GIF, or WebP up to 5 MB; SVG is not accepted.
Legacy MCP access keys are retired. Keys in headers or arguments no longer authorize MCP access. Reconnect agents with OAuth; CI jobs securely store and refresh OAuth tokens.
Device credentials live locally. The Mac app currently uses its Application Support configuration; the web inbox uses browser local storage — including, if you use sealed channels there, your inbox key.
Retention controls are not here yet. Visti does not currently offer self-service message deletion or retention settings.
Pairing is the account recovery path. There is no email or OAuth recovery flow today.