Security
The operator acts on your behalf, so this page sets out what it’s stopped from doing, what waits for you, and where that protection ends.
It checks before it acts
Every shell command and every file edit passes through a safety gate before it runs.
Some commands are refused outright. A force push to your main branch is one of them, and no approval overrides it.
Others wait for you. A recursive delete or a dropped database table stops until you approve that exact command. An approval covers one use and lapses after 30 days.
Everything else runs, and each action is recorded in an audit log. We switch this on for every operator install.
Its rules sit in a plain-text file you can read and change. So does its memory. Only the Telegram accounts you approve can reach it.
What the gate is not
The gate is a check inside Claude Code rather than operating-system enforcement. It hasn’t had an independent security audit.
Put a command to the gate
An illustration of the gate’s rules. It isn’t connected to a live system.
git push --force origin main
Refused. No approval overrides it.
When something goes wrong
There are three places to look.
- The gate. A command it stops comes back with the reason, and says whether your approval can release it. Nothing on the refused list can be approved.
- The audit log. We switch this on for every operator install. Every action is written to it, one file a day, kept on your machine and out of your GitHub backup. Each entry records the tool used, what it was given, and when.
- The outside check. We can build you a check that doesn’t depend on your machine, which messages you if the operator goes quiet, within hours rather than minutes. It can’t restart a machine that’s switched off.
Where your information goes
The operator can only be reached from Telegram accounts you approve. Beyond that, your information can sit in these places.
- On your machine: conversation history, the audit log, the memory and the operator’s rules.
- Kept out of your GitHub backup: the audit log, secrets files and the Telegram bot token.
- With Anthropic: the work Claude does, under your own plan and Anthropic’s terms.
- Through Telegram’s servers: the messages between you and the operator.
- In a private GitHub repository: memory and project files, when they’re pushed there.
- With us: only what we see on a screen share, through a login you give us, or in a file you send. For an operator install, our update server also records its licence name, when it last checked in and the country it checked in from.
- With any other service you connect to it: what that service needs, on its own terms.
Questions
Open a question to read its answer.
Could it do something I didn’t intend?
It acts on what you tell it, and it can make mistakes. That’s why the gate exists. Commands on its list that can’t be undone are either refused or held for your approval, and every action is logged. Not everything that can’t be undone is on that list: an email it’s allowed to send has gone. The gate has limits. A process started outside Claude Code isn’t checked, and someone who has already gained the ability to run code on your machine has known ways round it.
Has the safety gate been independently audited?
No. It hasn’t been through a third-party security audit. If your sector requires one, this isn’t the right fit yet.
Start with a conversation
Tell us how your business runs and what you’d hand over first. If Chancelry suits it, we’ll say so. If it doesn’t, we’ll say that too.