Docs Your data

Ownership and security

Your studio is yours: the data, the model, and the machine the work happens on.

Your data, in your cloud

The hub (the studio server) runs where you put it: your Railway or Fly.io account, any server with Docker, or a machine at home. One deployment is one studio, and its keys are yours. Steward the company never holds a copy. See Run your own studio.

All studio data is one SQLite file, steward.db, in the hub's data folder. Open it with any SQLite tool.

Open formats

The studio's records are a plain SQLite database.
The ledger is a table of events with JSON data. Nothing in it is ever edited.
Docs are Markdown. Code is git.

You can leave with everything, and it still makes sense without Steward.

Export and backups

Studio owners (the owners of #general) find these in Settings, then Your data:

Download the database. A consistent copy of steward.db, made while the studio runs, for someone who owns every business. It leaves out everyone's sign-in secrets (passcode and token hashes, sessions, passkeys, two-step secrets), DMs you aren't in, and other people's private notes. Put back as steward.db, it restores the studio, and people sign in again. The nightly bucket backup is the full copy.
Download as JSON. The ledger, businesses and charters, tasks, decisions, memory, numbers and spend, for the businesses you own. It leaves out passcode and token hashes, and other people's private notes.
Nightly backups to your own S3-compatible bucket, kept for as many days as you choose. Off until you set the bucket's keys. The copy goes only to your bucket.

Every export is written to the ledger with who made it.

Secrets and encryption at rest

What the hub keeps, and how:

Passcodes, sessions, invites and connector tokens are stored only as hashes. A copy of the database can't be used to sign in or connect an agent.
Integration secrets (API keys for GitHub, Railway, Resend, Bluesky, Stripe, model providers, push, backups and billing) stay in the host's environment variables. They are never written to the database, the ledger or the logs, so the database and its backups hold none of them.
Settings that aren't secret (a repository name, a from address, the studio's name) are plain rows in the database.

So the hub doesn't encrypt fields inside the database: it keeps nothing in there that would need it. The database file itself (your business records, messages and memory) is protected by where it lives. Use your host's disk encryption (Railway, Fly.io and the big clouds encrypt volumes at rest), and turn on server-side encryption in the bucket that holds your backups. Treat a downloaded copy like the studio itself.

Two-step sign-in needs a secret per person, so those are the one secret in the database. They're sealed with AES-GCM under STEWARD_SECRET_KEY, or under a key file the hub makes once in its data folder (secret.key). A copy of the database alone can't make codes.

Plan and billing: one number a month

Steward's price is a small monthly base plus a share of the revenue your businesses make. Billing never needs your data:

Nothing is sent until a studio owner turns on Report my revenue in Settings, then Plan and billing.
Then, once a month, the hub sends last month's total tracked revenue to the billing service: { "customer": "...", "month": "2026-10", "revenue_cents": 123456 }, signed with your studio's key. That is the whole message: no businesses, names, customers or numbers beyond that one.
Settings shows each report exactly as it was sent.
Turning it off stops reports straight away.

What leaves the hub

Only what you turn on: calls to the integrations you set up, your model provider in API mode, push services, your own backup bucket, the update feed (a read, nothing sent) and, with your opt-in, the one billing number a month.

Bring your own model

Connector mode. Agents think on your own computer, with the engine you choose: Claude Code, Codex, Gemini CLI, any command-line agent, or an API model, including one running on your own machine. The hub never sees your login.
API mode. @steward runs in the hub on any provider you set a key for: Anthropic, OpenAI, Gemini, OpenRouter, Groq, Ollama or your own OpenAI-style endpoint. Each business can pick its own model. Every call is priced and charged to the business it was for, so the budget caps work.

Details and setup: Bring your own model.

Coming: picking models per job by how well they score on that job's own tests for the money.

The connector connects out only

The connector on your computer asks the hub for work and posts replies. The hub never connects in. Nothing on your computer is opened to the internet. See The connector.

No secrets in chat

Never paste a password, key or token into a channel. Everyone in the studio can read channels, and the ledger keeps them.

Agents are told the same rule: never put secrets in chat. Connector tokens are shown once in Settings, never posted in a channel.

The hub does not scan messages for secrets. The rule is on you and on the agents.

What the hub stores

People: handle, name, and a hashed passcode. The passcode itself is never stored.
Sessions: a hashed token per signed-in device. Signing out deletes it.
Invites: hashed, used once, expire after 3 days.
Agents: handle, owner, who else may instruct it, and a hashed connector token.
Businesses: name, kind, owners and shares, budget, paused or not, charter.
Channels and messages.
Tasks and decision cards, with who decided what.
The ledger: every change, with who made it and when.
Model spend in API mode: tokens and cost per business and per person who asked.
Jobs: the queue of work for agents, and when each was claimed and finished.

What it does not store: your Claude login, your files, your email, or anything on your computer. A personal agent's work stays on its owner's machine. Only the reply it posts comes back.

Invite links work once and expire in 3 days.
Passcodes are at least 8 characters.
Passkeys. Add one in Settings, then Security (your passcode confirms it's you). Then sign in with Face ID, Touch ID or your device's PIN. Passkeys belong to the studio's address (PUBLIC_URL), so a new address needs new passkeys, unless PASSKEY_RP_ID names a parent domain both addresses share.
Two-step codes. Optional. After your passcode, you enter a 6-digit code from an authenticator app. Ten recovery codes, each good once, cover a lost phone.
Sessions. Settings lists where you're signed in (the device, when it was last seen), with Sign out for each and Sign out everywhere. A session ends after 30 days without use.
After 10 wrong tries from one place, or for one handle from anywhere, sign-in pauses for 15 minutes. Behind a proxy, the hub reads the visitor's address from the proxy's headers: set TRUST_PROXY=1 (Railway and Fly are detected).
Session cookies are HttpOnly, SameSite=Lax, and Secure in production. A request that changes something must come from the studio's own page: another site's Origin, or a sandboxed page's, is refused on the API and on the live connection.

Outside text and agents

Support emails, contact and feedback forms, applicants' proof, client call transcripts, web pages and logs are written by people outside the studio, and any of them can try to give an agent orders. So:

Agents get that text only as a labeled data block, and are told never to follow what's inside one.
A job that read outside text asks an owner (a decision card) before anything beyond the studio's own records, however trusted the action is. The one exception is the action the loop exists for, like answering the support email it read, which the trust ladder governs.
Those jobs can't change the charter, memory or a live page by themselves.
Work for a personal agent that carries outside text waits for its owner to start it (the Go ahead button on the handoff card, or a reply in the card's thread that mentions the agent), and runs without Railway, merging or web fetches. See The connector.

The full review is in Security review.