Two different places
Hewy does two jobs that sound like they shouldn't mix: it holds the keys that get you into your servers, and it runs AI agents that work on them. They're kept apart by where each one lives.
- Your keys live on your device. Your Mac, iPhone or Android phone.
- Your agents live on your servers. Claude, Codex and OpenCode run there, next to your code, under the Hewy Daemon.
An agent can only ever reach what's on the server it runs on. Your phone isn't one of those places.
Your device's key never leaves it
Each device makes its own SSH key the first time you use Hewy. On Macs and iPhones it's made inside the Secure Enclave, the chip that also guards Face ID, and it can never be copied out: not by an agent, not by Hewy, not by us. On Android it lives in the phone's hardware-backed keystore.
Private keys don't sync. Only key names and public halves follow you to your other devices; a new device makes its own key, and you choose which servers let it in. A key you import yourself stays on the device that holds it, unless you export it.
An agent can't approve itself
In Ask mode, an agent has to ask before it runs a command or changes a file. Your device shows you exactly what it wants to do, and your answer is signed with your device's key after Face ID, Touch ID or your passcode.
The Hewy Daemon on the server won't accept an approval that isn't signed, has expired, or was already used. The agent runs on the server and has no way to sign one, so it can't say yes to itself.
What an agent can reach on a server
An agent works as your account on that server, so it can use what you could use there. That's deliberate: it's how it edits your code and runs your tests. It also means:
- It's sandboxed on Linux. Agents can't touch the daemon or its settings, your shell startup files or your SSH configuration, while still working on your files.
- The server's own SSH keys are visible by default. If that server's account has keys in
~/.ssh, an agent can use them, as you could when logged in, so Git pushes and deploys keep working. For any server where an agent shouldn't reach your other machines, turn on Hide SSH keys from agents: agents there get an empty~/.ssh, at the cost of Git and deploys over SSH for agents on that server. - It only gets the API key it needs, and that key goes only to the provider you chose.
Who can get into what
Hewy shows every key and every server in one grid, so it's obvious which keys still open which doors, including the old laptop's you forgot about. Removing one is a click, and Hewy refuses a change that would lock you out unless you confirm.
What we can see: nothing useful
Your devices talk to your servers directly over SSH. Your chats, terminals and files never pass through us. What syncs between your devices (your servers, saved passwords and API keys) is encrypted on your device first, with a key we never have. Notifications are encrypted on your server, so Apple, Google and our push service carry only ciphertext.
The honest limits
- On Macs used as servers, agents run without a sandbox, because Xcode and Swift builds use Apple's own sandbox, which can't run inside another one.
- An agent can read what's on its server, and it sends what it reads to the AI provider you chose. Pick your servers, and their keys, with that in mind.
- An outside security review is planned. Until it's done, everything here is our own design and testing.
The full details, including how sync is encrypted and signed, are on the Security page. Found a problem? Email support@hewy.ai.