Trust
Last updated: 2026-10-27. This page is written for a security review. It states what exists today and labels what is planned; it claims no audit or certification we do not hold. Operator: Mirai Studio, Inc. (株式会社みらいスタジオ), Tokyo, Japan. Contact: security@spendctl.dev.
The shape of the service
Section titled “The shape of the service”- The sidecar runs on your systems. Policy, budgets, approvals and the payment ledger live in a SQLite file on the machine you run it on. It signs payment authorizations against a wallet you own (a Coinbase CDP server wallet or your own key). We never hold keys, funds or signatures, and nothing we host is on the payment path: the signed authorization goes from your sidecar to the seller.
- The hosted control plane meters licences. It receives one small check-in a day from sidecars that carry a licence key (next section), renews or revokes keys, and reports usage to us. A sidecar keeps enforcing its policy when the control plane is unreachable; by design an outage of ours never blocks a payment your policy allows.
- The sandbox at
mcp.spendctl.devis separate and login-free; it moves no real funds and keeps each sandbox for at most 24 hours (Sandbox).
The threat model for the sidecar itself is on the Security model page.
What leaves your systems
Section titled “What leaves your systems”| Component | Sent to us | Kept for |
|---|---|---|
| Sidecar without a licence key (Free) | nothing | — |
| Sidecar with a licence key (Pro, Team, Enterprise; 0.3 and later) | once a day: a random sidecar id, the sidecar version, the month, that month’s governed-payment count, the number of agents in the policy file | 13 months |
| Hosted sandbox | the sandbox’s own policy, mock receipts and approvals; tool name, outcome and client family for product metrics | 2 hours after the last call, 24 hours at most |
| Website | waitlist email, language and plan clicked; analytics with consent in the EEA, UK and Switzerland | waitlist until launch plus 12 months; analytics 14 months |
Never sent: agent names, hosts, paths, request or response bodies, prompts, tool arguments, wallet addresses, transaction hashes or network addresses. The privacy policy is the binding version of this table.
Subprocessors
Section titled “Subprocessors”| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | hosting of the website, the sandbox and the control plane (Workers, D1, KV, Durable Objects, Access, Email Routing, Analytics Engine); DNS; forwarding of security@ and other mailboxes | everything in the table above; email sent to our addresses | global edge; storage in the United States and the Asia-Pacific region |
| Google LLC | Tag Manager and Analytics for the website | page views, consent-dependent cookies | United States |
| Slack Technologies, LLC | internal notification of each waitlist sign-up | waitlist email, language, plan | United States |
| Stripe, Inc. (when paid plans open) | payments, invoices, tax | billing name, email, address, card data held by Stripe | United States |
npm and the GitHub Container Registry distribute the sidecar packages and image; they receive nothing about you from us. We add to this list before a new provider processes any of the data above and tell licence holders by email.
Retention and deletion
Section titled “Retention and deletion”- Your ledger stays yours. The sidecar’s SQLite ledger is on your disk and follows your retention;
ledger.purge({ agent, before })exists in the core library and aspendctl ledger purgecommand is planned. - Check-in records: 13 months. Organisation and licence records: until the organisation is deleted.
- Hosted ledger copy (planned, part of the control plane’s Pro features): Free 7 days, Pro 90 days, Team 1 year immutable, Enterprise up to 7 years, with scheduled exports. Until it ships, nothing of your ledger is stored with us.
- Deletion requests: security@spendctl.dev, answered within 30 days (privacy policy).
Zero-retention by default
Section titled “Zero-retention by default”The ledger records time, agent name, method, host and path (query string dropped), amount, asset, network, recipient, transaction hash, payer address, the decision and its reasons, approval ids and trace ids. It never records request or response headers or bodies, prompts, tool arguments, model output, or the IP addresses of agents. A per-agent zero-retention mode for the hosted ledger copy (decision and hashes only) is planned alongside that copy.
Access and encryption
Section titled “Access and encryption”- All traffic to spendctl.dev, api.spendctl.dev and mcp.spendctl.dev is TLS; control-plane data sits in Cloudflare’s storage, encrypted at rest by Cloudflare.
- The control plane’s administrative routes are reachable only through Cloudflare Access (the operator’s identity and one service token); the Worker verifies the Access token itself, so a request that did not pass Access is refused even if the edge rule were removed.
- A sidecar authenticates to the control plane with its licence token only. Licence tokens are Ed25519-signed and verified offline by the sidecar; the private keys are not in any repository or CI system.
- No employee or contractor other than the operator has access to the control plane or its database.
Vulnerability disclosure
Section titled “Vulnerability disclosure”Email security@spendctl.dev; do not post publicly. We aim to acknowledge within 72 hours and to ship a fix or mitigation for confirmed high-severity issues within 14 days. Scope and what to include: Security model. There is no bug bounty programme.
Availability and incidents
Section titled “Availability and incidents”- The sidecar does not depend on us to run: a control-plane outage leaves every entitlement in place and the sidecar warns once a day until it can check in again.
- Incidents affecting the control plane or the sandbox are posted in the
#announcementschannel of the community Discord and mailed to licence holders. A public status page is planned.
Audits, certifications, agreements
Section titled “Audits, certifications, agreements”- None yet. We do not hold SOC 2, ISO 27001 or any other certification and will not say otherwise until an audit exists.
- Data processing agreement: planned; until then the privacy policy and the terms describe the processing. If your review needs a signed DPA before then, write to security@spendctl.dev.
- What we can share on request: this page, the data-flow description above, the sidecar’s threat model, and the source of the client SDK (Apache-2.0, github.com/miraistudio/spendctl-sdk).
Mirai Studio, Inc. (株式会社みらいスタジオ), Tokyo, Japan. Governing law and the rest of the contract: Terms. Our reading of the money-transmission question (the service holds neither funds nor signatures) has been reviewed by counsel; it is a reading, not a licence, and does not replace your own.