Security
Built so even we can't use your keys.
Hewy holds the keys to your servers, so it's built so that we can't use them, and neither could anyone who broke into our servers. This page explains how, in plain language.
Who can see what
Your devices hold everything. Our server holds only what your devices sealed first, and nothing it could use.
| What | Your devices | Your servers | Hewy's server | The AI provider you chose |
|---|---|---|---|---|
| Your servers' names and addresses | ||||
| Saved passwords | ||||
| API keysEach server gets only the keys you give it | ||||
| Your devices' SSH private keysMade in the Secure Enclave, never synced | ||||
| Terminal sessions and filesAn agent sends its provider what it reads | ||||
| Your chats with agentsThe provider gets what the agent sends it | ||||
| Your master password | ||||
| Your email address |
- Can read it
- Holds it encrypted, without the key
- Never gets it
Your devices talk to your servers directly
Nothing about your work passes through us.
Straight over SSH
Your Mac and iPhone connect straight to your servers over SSH. Your terminal sessions, files and conversations with agents never pass through our servers.
Server identities are remembered
The first time you connect, you check the server's identity and Hewy pins it. If it ever changes, Hewy stops before sending a password or signing anything.
Sync we can't read
Your servers, saved passwords and API keys follow you between devices, sealed before they leave each one.
Your master password never leaves your device
Your device turns it into two keys: one proves it's you to our server, and the other unlocks your data. We only ever store a fingerprint of the first, and never see the second.
Everything you sync is encrypted on your device first
Your servers, their identities, saved passwords and API keys. Our server stores scrambled data it has no key for, padded so that even sizes reveal little.
Every change is signed
By the device that made it, and chained to the change before it. If our server, or anyone who broke into it, altered, reordered or rewound your data, your devices would notice and refuse it.
Adding a device
Sign in with your password, or scan a QR code shown on the new device with one that's already signed in. The QR code goes straight from one screen to the other camera, so the server can't intercept it.
A recovery code, if you make one
It's shown once and never stored on your devices. It gets you back in if you forget your password and lose every device.
Removing a lost device
It's signed out for good, and your account's encryption key changes, so it can't read anything synced after that.
Keys that stay put
A key that can't be copied can't be stolen from a backup, a sync or us.
Each device makes its own SSH key
On Apple devices it lives in the Secure Enclave and can never be copied off. Private keys never sync.
Adding keys can't lock you out
When you add keys to a server, Hewy backs up the file first and refuses changes that would lock you out, unless you confirm.
Agents on your servers
Agents work on your servers, and ask before they act. Your answer is yours alone to give.
Signed approvals
When you approve something, your device signs exactly what the agent asked to do, using a key that needs Face ID, Touch ID or your passcode. The Hewy Daemon on your server won't accept an approval that isn't signed, has expired, or was already used.
A sandbox
On Linux, agents run in a sandbox that keeps them away from the daemon and its settings, and stops them changing your shell startup files or SSH configuration, while still letting them work on your files.
Your server's SSH keys
Agents can use the server account's SSH keys, as you would there, so Git and deploys over SSH keep working. Turn on "Hide SSH keys from agents" for any server where an agent shouldn't be able to reach your other machines.
Connections between chats
No agent can message another until you connect their two chats, and you choose the direction, what may travel and for how long. A message from another chat reaches the agent marked as from an agent, not from you, so it can't approve anything, and each chat's own approvals still apply. Files are read by the sending agent's own tools, inside its sandbox on Linux, so it can only send what it could read anyway. Your own devices carry the messages; servers never connect to each other, and nothing passes through ours.
Encrypted notifications
The text is encrypted on your server for your devices. Apple and our push service only ever carry ciphertext and a generic "Open Hewy" message.
Signed releases
Every release of the daemon is signed with a release key kept offline, never on our build machine, and Hewy checks that signature and the checksums before installing it on a server. The daemon never opens a network port.
Your own API keys
Each server keeps them in a file only your account there can read. Agents receive just the key they need, and it goes only to the provider you chose.
What our server can see
Everything else stays between your devices and your servers. There are no analytics or tracking tools in the apps or on this site.
We store
- Your email address
- A fingerprint of your login key
- Your data, encrypted, with padded sizes
- Device ids and their public keys
- When devices sign in and sync
- Your subscription's status, if you subscribe while signed in
We never see
- Your master password
- The names or addresses of your servers
- Your SSH keys, saved passwords or API keys
- Your conversations with agents, or your files
- Your dictation audio
- Your payment details
What happens if…
…someone breaks into our servers?
They'd find email addresses and data they can't read. They couldn't alter your data without your devices noticing, and there's nothing there that could log in to a server.
…you lose your iPhone?
Its key can't be copied off it, and without your passcode it can't approve anything. Remove it from another device in Settings → Devices, and it's signed out for good.
…a server's identity changes?
Hewy stops before sending a password or signing anything, and tells you. On a private address it may just be another machine on a different network, and Hewy says so calmly.
…an agent wants to do something risky?
Unless you've given it more freedom, it asks first and waits. Your answer is signed on your device after Face ID, Touch ID or your passcode, and the daemon refuses an answer it can't verify.
The trade-offs, and known limits
Nobody can reset your master password
Anyone who knows your master password can sign in as you, so use a long passphrase and keep it in a password manager. Nobody, including us, can reset it. A recovery code, if you make one, is the way back in.
Known limits
- On Macs, agents run without a sandbox, by design: Xcode and Swift builds use Apple's own sandbox, which can't run inside another one.
- An outside security review is planned before the App Store launch.
Found a security problem?
Email support@hewy.ai, and please don't share it publicly until it's fixed.
Your keys stay home.
Try Hewy free for 14 days, then US$99 a year or US$9.99 a month. No Hewy account needed to start.
Coming soon forMaciPhoneAndroidRead the privacy policy →