What stays with you, and what we keep.

Your keys and code stay on your machine

Claude Code, Codex or your Python agent runs on your computer, with your files and your model API key. Covo never asks for that key, and the panel never needs it.

A shared session sends the conversation and its steps: messages, the tools the agent calls, their arguments and results. It does not send your repository.

Covo runs no agent and no model

The Covo server relays and stores sessions. It does not host an agent, and no language model runs on it or is downloaded to it. A test in our build fails if the server image or the deploy files name a model.

Optional AI summaries call an external endpoint only when the operator sets one (COVO_LLM_PROVIDER). Without it, that feature is off.

Secrets are masked before they leave

The Covo SDK masks secrets on your computer, before anything is sent: in read-only transcript shares, in live Claude Code and Codex sessions (prompts, tool arguments as approvers see them, results, errors), and in sessions exported for a fork. One rule set does all of it: redaction.v1.json, version 1.

• covo-owner-codeCovo owner codes in links
• private-keyPEM private keys
• provider-and-github-keysProvider API keys (sk-…) and GitHub tokens
• aws-access-keyAWS access key ids
• google-api-keyGoogle API keys
• slack-tokenSlack tokens
• jwtJSON Web Tokens
• bearerBearer tokens in headers
• url-passwordPasswords inside URLs
• credential-assignmentA value written after a name such as api_key, token, secret or password

Pattern matching cannot find every secret. Keep what must never be shared out of the session. See the masking in the demo replay.

Your address and password, encrypted at rest

Your e-mail address is stored encrypted with AES-256-GCM. To find your account at sign-in, Covo compares a keyed HMAC of the address (a blind index), so the database holds nothing that reads as an address.

All of these keys come from one root key, COVO_DATA_KEY, which lives in the server’s environment and never in the database. In production the server does not start without it. A copy of the database alone reveals neither who has an account nor how to reach them.

What this does not cover: session records (the masked messages and steps) are stored in the database so your teammates can open them. They are not end-to-end encrypted.

Your password is never stored

Covo keeps a scrypt hash, salted per password and computed over a server-side secret (a pepper derived from COVO_DATA_KEY), at the cost OWASP recommends (N=2¹⁷, r=8, p=1).

New passwords need at least 10 characters, may not contain your name or address, and are checked against known breaches through Have I Been Pwned’s k-anonymity API: only the first five characters of a SHA-1 hash leave the server.

Two approval modes: Approve only and Auto

Approve only is the default. Each tool call that needs approval waits until the person who controls the agent approves or rejects it. For Claude Code those tools are Write, Edit, MultiEdit, NotebookEdit and Bash, and you can change the list (for example Bash(git push*)).

Auto approves each request at once, like auto mode in Claude Code or Codex. Only the controller can switch the mode, and the switch is recorded in the session for everyone to see. One person controls the agent at a time.

Stop sharing whenever you like

Stop sharing is on your Sessions page and in the session’s Access dialog. It ends the share, not your work: the agent keeps running on your computer, privately. An approval that was waiting can no longer continue.

People who were in the session can still read what was shared until then. Sharing again from that computer starts a new session. Disconnecting a computer from Covo also ends every share it hosts.

Signing in

No account exists until you confirm your address. Confirmation and reset links are 256-bit random, stored only as hashes, single use, and expire (24 hours and 1 hour). Sign-up, sign-in and “forgot password” answer the same way whether or not an address has an account, and each is rate limited.

Each sign-in gets its own random token, stored hashed, that expires after 30 days. Your Account page lists every browser, terminal and paired computer, and you can end any of them. Pages carry a strict Content Security Policy (scripts only with a per-request nonce, no framing).

Who can open a session

Only people with the current invite link can join a session. The host can remove anyone or refresh the link, and the old link stops working.

Leaving

Delete your account from your Account page. Your address, password hash and username are erased, not archived, and every sign-in ends. Messages you wrote in sessions you shared stay with the teammates you shared them with, shown as “Deleted account”.

What Covo does not offer yet

Covo is in public beta. There is no SSO and no SOC 2 report today. If your team needs them, write to us before you depend on Covo.