Security at Squillo

Squillo's most important security claims are properties of the architecture: you can observe them on your own machine. Below is how the system works. Where something is a design goal rather than a shipped, verifiable fact, we say so in the same sentence.

Your data lives in storage you control

Squillo is not a data host. Your documents, vaults, and their history live in storage that belongs to you: your own cloud drive, your local disk, or your own peers. Squillo keeps no central store of your documents. The storage provider you choose is the source of truth; your device holds a local cache, works offline, and the two reconcile when you reconnect.

Access is denied by default

Every access decision in Squillo starts from "no." Permissions are layered: organization roles, vault roles, and per-file access controls. The per-file layer can only tighten what the layers above allow, never widen it, and it fails closed when in doubt. Administering an organization is a separate permission from reading any vault's contents, and private vaults have no admin exception.

Every file is a permissioned, append-only ledger: history is preserved, not quietly edited. Every read is checked against permissions, and every change leaves a record — including rollbacks, which add to history instead of erasing it.

The control surface never leaves your machine

Agents and tools drive Squillo through a local control plane bound to your machine only. It is not reachable from your network or the internet. Every call must present an API key that exists only while the server runs and never leaves your machine. There is no open network port and no shared cloud credential. Anything that drives your Squillo must already be on your machine, holding your key.

An agent can never exceed its human

An agent's authority is the intersection of what the agent is granted and what its human is allowed. No configuration lets your agent read something you could not read or do something you could not do. The same rule protects your data from everyone else's agents. An administrator's agent sees no more than that administrator personally could.

Every agent action traces to a person

Squillo notarizes the actions agents take on a person's behalf using APH ("Agent per Human"), an open protocol whose envelopes are W3C Verifiable Credentials. When an agent posts or acts in a shared space, the action carries a cryptographic stamp binding it to the human whose agent produced it. Actions trace to people, not to anonymous bots.

Two stamps exist, and Squillo labels which one you are looking at. NotarizedV1 is the full claim: a signature binding the human as the cryptographic principal. SystemV1 ("System Verified") is the fallback when full notarization is not available: a locally-authenticated, machine-authored stamp. It is a weaker claim, and it is labeled as one. The protocol is public: read it on our APH page or in the open specification.

Releases are signed, and the verifying key is compiled in

Every Squillo release manifest is cryptographically signed. The verifying public key is compiled into the binary itself: no file, no URL, and no environment variable can widen the set of accepted signers. Changing the trust root requires shipping a new binary, by design. A manifest signed by any other key is refused. Shipping macOS builds are additionally Developer-ID signed and notarized by Apple.

We watch what leaves the machine

Squillo ships an egress guard for the third-party coding agents you run on your own machine. It watches their outbound traffic for one narrow class of calls: the agent vendor's own analytics and crash-reporting endpoints. The guard is allow-first: an unlisted host always passes, and the agent's real API traffic is never touched. Where the guard cannot yet enforce a block, it meters instead: it records what it would have blocked and reports those bytes as metered, never as prevented.

What we cannot show you yet

Squillo does not yet hold a third-party security certification such as SOC 2 or ISO 27001, and this page will not imply otherwise. What we offer today: security-relevant claims that are individually checkable, the ways to check them below, and a commitment to publish formal audit results here when we have them.

Check it yourself

Boot Squillo in its demo mode to get a throwaway vault and inspect the same local discovery surface agents use. Read the open APH specification and verify a stamp's envelope yourself. Read what your organization's admins can and cannot see. For the website you are reading now, see the privacy policy.

Security FAQ

Where is our data stored, and who hosts it?

In storage you control: your own cloud drive, your local device, or your own peers. Squillo is not the host of your vault content — there is no Squillo-side copy of your documents. Account and website information for squillo.com is covered separately by the privacy policy.

Can Squillo employees read our documents?

Your content lives in your storage, not on Squillo servers; there is no central content store for our staff to browse. On your side, access is deny-by-default: what anyone sees is what a rule explicitly grants them, and nothing in that rule set is written for us.

What can our organization's administrators see about members?

We publish a plain-language disclosure at squillo.com/what-admins-see: the roster, work placed in shared vaults, organization-level spend, policy, and audit events — and what they cannot see: personal accounts and vaults, screens and keystrokes, private storage and keys. That page is linked from every member invitation before anyone installs anything.

Can an agent take an action its operator could not?

No. An agent's authority is the intersection of its own grants and its human's, so it can never exceed the person it acts for. The channel it acts through is local-only and key-gated, and the actions it takes in shared spaces are cryptographically stamped to its human.

How would we audit what happened?

Storage is an append-only ledger, so history in shared spaces is preserved, including rollbacks. Agent actions carry APH stamps identifying the human behind them, and each stamp states its own strength (NotarizedV1 or SystemV1). On plans that include audit, organization admins can also read the organization's audit log of org-level events.

How is the update channel secured?

Release manifests are cryptographically signed, and the verifying key is compiled into the binary you already run — the set of accepted signers cannot be widened by any file, URL, or environment variable. An update whose manifest is signed by any other key is refused. Shipping macOS builds are additionally Developer-ID signed and notarized by Apple.

Are you SOC 2 or ISO 27001 certified?

Not yet. SOC 2 and ISO 27001 work is underway (as of 2026-09-17), and this page will link each report when it is earned. What we offer today is architectural: your content stays in your storage, access is deny-by-default, the control plane is local, agent actions are attributable, and releases are signed against a compiled-in key. Each of these you can verify without trusting us.

Does Squillo phone home?

Your API keys and vault contents stay local, and your content is not sent to us; the system is designed so we are not in its data path. The egress guard watches third-party coding agents' calls to their vendors' analytics endpoints and reports what it metered versus what it blocked. The squillo.com website itself is covered by the privacy policy.

Questions

If anything on this page is unclear, or you believe something you observe contradicts it, contact us at [email protected]. This page describes the platform's design and current behavior; where the two differ, we treat the page as the defect and fix it.

Last verified: 2026-09-17