Security

What runs where, what OKed stores, and what is denied when a decision does not come back. The privacy policy is the full account of personal data.

Where it runs

The Claude Code integration is a hook outside the agent process, so the agent cannot turn it off by changing its own permission mode. Codex CLI, Cursor, and GitHub Copilot integrations are also hooks in a separate process. Safe actions are classified on your machine, with no network call. Review and high-stakes actions are sent to OKed and wait for a person.

The Vercel AI SDK, OpenAI Agents SDK, and LangGraph packages run inside your agent process and wrap the tool. LangGraph support is JavaScript for now. Set OKED_API_KEY to a key from the dashboard. These packages have no pairing command. A denial or a timeout does not run the tool. Approvals arrive on Telegram or the web dashboard.

What we receive

For a flagged action, OKed receives the action type, agent identifier, tier, timestamps, the action's description and parameters, and your approve or deny decision. That description and those parameters are the audit trail. They can include the command, the SQL, or the message the agent was about to send.

Safe actions stay on your machine. OKed does not get a copy of them.

What stays local

The Claude Code, Codex, Cursor, and GitHub Copilot hooks write a decision log at ~/.oked/hook.log (mode 600). A line records the time, decision, tool, tier, reason, approval id, receipt id, and any error. The log does not hold the tool input or the command. Above 1 MB it rolls to hook.log.1. Set OKED_HOOK_LOG to use another file.

Receipts

Each decision is signed by OKed with Ed25519 and hash-chained to the previous receipt. Your copy lives in ~/.oked/receipts.jsonl. Check it with oked receipts verify. An export from the dashboard is checked offline with npx @oked/verify. The format is documented in docs/receipts.md.

A receipt records who decided, how they were verified, when, and a digest of the exact action the agent sent. The readable summary is the title you were shown, unless you turned summaries off. The export holds those digests, not the commands themselves. Since version 0.6.0, the hook denies an approval that arrives without a valid receipt. The Vercel AI SDK, OpenAI Agents SDK, and LangGraph packages deny in that case too. Set OKED_REQUIRE_RECEIPT=0 only for a backend that does not sign receipts.

A person can decide on Telegram or the web dashboard. iPhone Soon. A rule or a timeout is labeled as such on the receipt, and is not recorded as a person's approval.

When things fail

An explicit denial denies the action. An invalid API key, a receipt that does not verify, and an unexpected hook error also deny it. If nobody answers within 10 minutes, the request times out and the action is denied.

If the OKed backend is unreachable, the Claude Code, Codex, Cursor, and GitHub Copilot hooks, the SDK, and the Vercel AI SDK, OpenAI Agents SDK, and LangGraph packages deny high_stakes actions and, by default, allow lower tiers to continue. Set OKED_STRICT_FAIL_CLOSED=1 to deny every sensitive action during an outage. The backend counts as unreachable when the connection fails, when it answers with HTTP 5xx, when the hosting platform answers in its place, or when the reply is not JSON.

Two cases are not an outage. If no API key is configured, the Claude Code hook returns ask, and Claude Code's own permission flow decides. Codex, Cursor, and GitHub Copilot deny instead. The reason is Pair first: run oked-codex init, Pair first: run oked-cursor init, or Pair first: run oked-copilot init. They do not print ask. The Vercel AI SDK, OpenAI Agents SDK, and LangGraph packages also deny when no API key is set, and the tool does not run. If too many approvals are already waiting (HTTP 429), the action is denied until you decide those first.

Codex fails open if the hook errors, times out, or prints malformed output. The installer sets the hook timeout to 690 seconds so the SDK's deny, at 630 seconds, is written first when Codex honors that timeout. Command hooks do not run in Codex cloud.

Cursor is installed with failClosed: true, so a crash, a timeout, or no output denies. Cursor does not document a maximum timeout. A 10 minute wait has not been confirmed inside the Cursor app. On a reported Windows CLI bug, the verdict is dropped at the deadline, and failClosed denies an approval as well. If a Claude Code hook is imported instead, it has no failClosed field, and a timeout of that hook fails open.

GitHub Copilot denies on a crash or any non-zero exit. A timeout fails open, including for a policy hook, and there is no failClosed field. The installer sets timeoutSec to 690. Copilot's default is 30 seconds, and the docs state no maximum. VS Code hooks are Preview. The cloud agent loads .github/hooks/oked.json only, and it can reach api.oked.ai only when an org admin allows that host.

The NVIDIA OpenShell middleware is stricter on an OKed error: it blocks the request (oked_unavailable_request_blocked). Reads it has already classified locally still pass.

Storage

Approval requests, decisions, and audit logs are stored in PostgreSQL on Railway in the United States, over TLS. Audit data is kept for 3 years after your last account activity, then deleted, unless a legal hold requires longer. Details are in the privacy policy.

Deletion

Delete the account on the dashboard, under Settings, Delete account. Deletion is immediate. It removes the account, linked iPhones, rules, agent keys, the Telegram link, push subscriptions, and approval requests with their audit logs. Signed receipts are kept. They cannot be changed or deleted, because the people you share them with can still check them.

Training

The contents of action descriptions and parameters are not used to train classifiers without your explicit opt-in.

Report an issue

Email contact@oked.ai. For the OpenShell middleware, use GitHub private vulnerability reporting on that repository. Please don't open a public issue for a security problem.