Trust & privacy

Where your data is, at every step.

OneHuman runs inside your own server. The decision about what an AI agent may see is made next to your data and never leaves it. This page is for the security and legal reviewer: what stays, what leaves when you choose to send it, and what is never collected (by construction, not by policy).

Stays on your server

  • Every decision, with its evidence and reasons
  • The hash-chained audit log
  • The signed proof of each decision, and the private key that signs it
  • Session records and their agent/human state
  • Passkey credentials your users register
  • Your policy file and your mask functions

Leaves only if you add an API key

  • A one-way digest of the session id (never the id)
  • Resource name, decision, actor, session state
  • Detected agent product names and reason codes
  • Enforcement mode and engine version
  • The signed proof: the same fields, signed
  • Your rules (the policy file), so the portal can keep, version and sign them
  • The names you pass to protect(), e.g. balance.read, so the portal can show parts without a rule
  • Which rules version runs, and whether it came from the portal, the saved copy or the file
  • Nothing else. Remove the key and nothing leaves.

Never collected, anywhere

  • Request or response payloads
  • What the person typed: no keys, no characters, no form values
  • Page text or the content of what was displayed
  • Names, e-mails, account numbers, customer identities
  • IP addresses in reports
  • Cross-site identifiers or tracking fingerprints

Check it yourself: npx onehumanai inspect prints exactly what the page script sent in a session, from your own database, byte for byte when the server runs with ONEHUMAN_RECORD_RAW=1.

The page script measures how the session behaves (timing, movement geometry, known agent-tool traces), not what it contains. It is served from your origin and posts only to your origin.

The path of one decision

BrowserThe page script sends behavioural metadata to your server. Data already on screen is redacted the instant an agent appears.
→ your origin only
Your serverThe engine decides allow · mask · step up · block, writes the audit row, signs the proof. Your handler returns full or masked data.
→ opt-in, metadata
OneHuman portalWith an API key, a report of the decision (fields above) arrives in the background, batched, off the request path. It never blocks your response.

What the portal stores

Your account

  • Your e-mail address
  • A scrypt hash of your password, never the password
  • API keys as SHA-256 hashes; the raw key is shown once

Per API key

  • The decision metadata listed above
  • Your rules, every version, and who changed what and when
  • The public keys your server signs proofs with

Never, in the portal either

  • Your users' data, payloads or page content
  • Your server's secret or the private key that signs proofs
  • IP addresses of your users

What OneHuman does not do

Said plainly, so nobody finds out in production.

API keys and server calls

  • If an agent calls your API with a customer's API key or token, there is no browser and no page: OneHuman sees nothing. It protects logged-in web accounts.

Native mobile apps

  • iOS and Android apps are not covered. Mobile browsers are, but a tap often stays “undecided” today. Your rules say what happens then.

Backends that are not Node

  • Node runs the middleware directly.
  • Python: adapters for Flask, Django and FastAPI are in the repo (packages/python). They call a small local service, npx onehumanai sidecar, so Node has to run next to your app. The package is not on PyPI yet: pip install onehumanai does not work today, so install it from the repo.
  • .NET and Java: adapters are in the repo (packages/dotnet, packages/java) and use the same local service.
  • Go, Ruby and PHP: no adapter yet.

Identify people

  • It answers one question per session: is a program acting? It keeps no profile of a person. A passkey proves presence, not identity.

Stop every script

  • A script written for one site that fakes a human pointer can pass the behaviour check. That is why critical actions ask for a passkey. What gets through →

Send your data anywhere

  • Detection, rules, audit log and proofs run on your server. The portal only gets decision metadata, and only with an API key. See “Stays on your server” and “Leaves only if you add an API key” above.

Questions a reviewer asks

Where does OneHuman run?
As a library inside your Node process. Storage is your SQLite file or your libSQL database. There is no OneHuman component in the request path other than your own server.
Can we run it fully disconnected?
Yes, with a license file from OneHuman Inc. (Enterprise): detection, policy, audit, proofs and passkey reclaim all work offline and nothing calls out. Agent signature updates then arrive with package updates. With an API key instead, the server asks the portal for its license every six hours; only the key is sent, never anything about your users.
What is in the portal, and where is it hosted?
Aggregates and the decision log built from the metadata above, per API key, for your account only. The portal is hosted on Vercel; its data is kept in Google Cloud Firestore (United States), and sign-in runs on Firebase Authentication. Sub-processors: Vercel (hosting), Google Cloud and Firebase (database and sign-in), Resend (the portal's e-mails) and OpenRouter (the AI model behind the rules assistant and this website's chat; it receives only what is typed into them). No advertising or analytics processors.
Where do the rules come from, and can someone change them in transit?
With an API key, your rules live in the portal: the file in your code becomes version 1 on first start, and later edits go there too. The portal signs each version (Ed25519) for your key only. Your server accepts nothing unsigned or altered, pins the portal's key the first time it sees it, and keeps the last signed copy. If the portal is down, protection keeps running. Changes that lower protection or affect real people wait for your approval and your password.
Does the rules assistant see our data?
No. The assistant on the Rules page is used only when you type into it. It receives your message and your rules (names, labels and settings) and sends them to an AI model through OpenRouter. It never receives traffic, sessions, users or keys, and it can only change the rules you already have; you review every change before it is saved.
How long is telemetry kept?
Until you revoke and delete the API key, which removes its reported decisions. Revoked keys can be deleted at any time from the portal.
What does onehuman.ai log about visitors to this website?
This site (not your app, and not the package) keeps a visit log for its operators: the page or demo action, the time, browser and OS family, phone or not, the country and city our host reports, and a keyed hash of IP address + browser so repeat visits count once. No raw IP address, no raw user agent, no tracking cookie of ours. The chat on the public pages is our own: what you type there, the page you opened it on and your country are kept so a founder can read and answer it, and your messages go to an AI model through OpenRouter for the instant reply. It sets no cookie; the conversation is tied to this browser by a random key in its local storage. A chat is deleted 12 months after its last message, or sooner if you ask arif@onehuman.ai. Kept 90 days; demo rooms and their decisions 60 days. The demo video on the homepage plays from YouTube (youtube-nocookie.com) only after you allow it, in the cookie choices or on the video itself; YouTube may then store data in your browser. Your cookie choice is kept in this browser's local storage and can be changed from "Cookie settings" at the bottom of every page.
Can our auditor verify a decision without trusting you?
Yes. Every decision is signed on your server with a key derived from your secret. The public key is served from your own site; the proof verifies with any standard JOSE library or npx onehumanai verify-proof. OneHuman the company is not in that loop.
Can the signing key be rotated, and can a chain be dated independently?
Yes. ONEHUMAN_PROOF_EPOCH moves signing to a new key while the older public keys stay published, so every earlier proof still verifies; before changing the secret itself, npx onehumanai proof-keys prints the keys to keep. For a date nobody on your side can change, turn on anchoring: every hour the audit chain's newest hash (only that hash) goes to an RFC 3161 timestamp authority you choose, and npx onehumanai anchors --out dir writes files an auditor checks with openssl ts -verify. Anchoring is off by default.
What if OneHuman is slow or breaks?
Your app keeps working. OneHuman fails open: a protected request waits at most one second (you set it) for a decision; if the engine is slower or fails, the request goes on as if allowed, is logged as an unknown visitor and counted in the health endpoint. In observe mode this is always so. In enforce mode you may choose a 503 instead, per deployment. OneHuman's own routes answer their own errors and never reach your error handler.
Does the page script affect our users?
It is first-party, adds no third-party requests, sets one first-party cookie for the session, and changes nothing a person sees. The one exception is redacting sensitive fields the moment an agent attaches, which is the point.
Is behavioural data biometric?
OneHuman does not identify people and keeps no per-person template. It answers one question per session (is an agent operating it?) from evidence of the session, and discards the raw movement stream. Nothing can be matched across users or across sites.
Security contact
Write to arif@onehuman.ai (policy: SECURITY.md). Acknowledgement within 72 hours; a fix or mitigation plan within 14 days for confirmed issues.
Need a DPA, a sub-processor list on letterhead, or a security questionnaire filled in? Write to arif@onehuman.ai.