Security model - Docs

DeskWink is built on one assumption: the AI on the other end can be wrong, and can be misled by text it reads, such as a hostile instruction hidden in a document. So DeskWink does not rely on the AI to behave. The important limits are enforced on your computer, by software the AI cannot change, and the important decisions are yours.

Five layers, and any one can say no

A request from your AI is allowed only if every one of these layers allows it:

Built-in limits. Blocked file types and locations, size limits and rate limits that no plan and no setting can lift.
Your plan. How many computers and how many AI actions each month.
What you granted the AI app. When you connect an AI app, you choose which of your computers it can reach and what it may do.
Your computer’s own policy. The folders you shared and the abilities you turned on, set on that computer.
Your approval. Changes to files, and later commands, wait for you.

Paying for a plan changes the numbers in layer 2. It never skips layers 4 and 5.

The cloud can narrow, never widen

Sharing a new folder, making a folder writable, turning on commands and removing the block on sensitive files can only be done on the computer itself, with the deskwink command, by you. The console can remove a folder, switch an ability off or revoke an AI app, but it cannot grant more. So even if DeskWink’s servers were compromised, they could not widen what an attacker can reach on your computer.

Some of these commands refuse to run when they are started by another program rather than typed by a person in a terminal. This includes sharing a very broad folder, turning on commands and approving a command. If you let a coding agent install DeskWink for you, it can only open the empty default ~/DeskWink folder unless you name another one.

Your computer connects out

DeskWink opens a connection from your computer to DeskWink. It opens no port that the internet can reach.
DeskWink runs only after you start it with deskwink launch. It does not start at login by default. deskwink stop ends it immediately.
If your computer is off or DeskWink is stopped, requests fail at once. There is no queue, so an old request is never run later.

Three separate sets of credentials

Signing in to the website, the key your computer uses to prove itself, and the permission an AI app holds are three different things, and none can stand in for another.

Your computer’s key is created on the computer. DeskWink keeps the public half; the private half stays in the computer’s protected storage and is never sent anywhere.
The access an AI app holds is never forwarded to your computer. Your computer only talks to DeskWink with its own key.
DeskWink decides who is asking from the sign-in on the server. It never trusts a user or computer name sent by the caller.

Folders

Every path your AI sends is checked on your computer before anything happens:

It must be inside a folder you shared. Paths using .., symbolic links, Windows junctions, short 8.3 names, different letter case, alternate data streams or device names are resolved and re-checked, and refused if they lead outside.
To change a file, the folder must have been shared with --write, and the target must be a real file, not a link.
Your home folder can only be shared in an interactive terminal with an explicit flag. Whole drives and system folders cannot be shared at all.

Files that stay blocked

Blocked	What	Can you lift it?
Always	DeskWink’s own folder and program files; system folders; places that start programs at login; shell start-up files; the inside of `.git` folders.	No
By default	`.ssh`, `.gnupg`, `.aws`, `.azure`, `.kube`, Docker and npm credentials, `.netrc`, `.git-credentials`, `.env` files (except `.env.example`), `.pem`, `.key`, `.p12`, `.pfx`, SSH key files, password databases, and browser profile data such as saved logins and cookies.	Yes, but only on the computer

Changes to files

Your AI asks to write or edit a file. DeskWink prepares the new version on your computer without touching the original.
You see the exact difference in the console and approve or reject it.
On approval, DeskWink checks the file has not changed in the meantime, checks all the rules above again, saves a backup of the original, and then replaces the file in one step.
You can undo it with deskwink restore. Backups are kept on your computer for 7 days.

Commands

Running commands is off by default and is planned for the Pro plan.

You turn it on in a terminal on the computer, and have to type the computer’s name to confirm.
Each command your AI asks to run shows up on your computer. It runs only after you approve it there, in an interactive terminal, after seeing the full command and folder.
The web console can reject a command but can never approve one. No message from DeskWink’s servers can make your computer run a command that you have not approved.
Control characters in a command are shown visibly, so a command cannot disguise itself in your terminal.

Limit

A command you approve runs as you, with everything your user account can do. It is not sandboxed. The protection is that a person reads every command before it runs. Read what you approve.

What DeskWink stores

Stored	Not stored
Your email and name, the sign-in provider’s ID, computer names, system and DeskWink version, shared folder names and paths, a short activity record (which tool, which path inside a folder, when and the result), and security events.	File contents, differences between versions, command text and command output, screenshots, and the access tokens your AI apps hold.

File contents and command output do pass through DeskWink’s servers in transit, because that is how they reach your AI. They are not written to the database, logs or backups. Retention periods are in the Privacy Policy.

Stopping everything

deskwink stop: on the computer, stops DeskWink at once.
Emergency disconnect in the console: disconnects all your computers. To come back, you resume them in the console and run deskwink launch on each.
Revoke an AI app in the console, or remove the connector in the app.
deskwink logout: removes this computer from your account and deletes its key.

What DeskWink cannot protect against

What the AI sees goes to the AI provider. When your AI reads a file, the contents become part of your conversation with Claude, ChatGPT or whichever app you use, under that provider’s terms and privacy policy. Share only folders you are comfortable giving to that AI.
Hostile text in files. A document can contain instructions aimed at the AI. DeskWink does not follow instructions in files and every change needs your approval, but you should still read what you approve.
Someone with your signed-in computer or account can do what you can do. Lock your computer and protect your sign-in.
Software bugs. DeskWink is in closed beta. We test the security rules before building the features they protect, but no software is free of bugs.

Found a weakness? Please tell us at [email protected]. The security page explains how.