Governance and security
EnterDone puts an AI agent to work inside a company — with access to systems, files and conversations. That power is only acceptable with deterministic governance: AI proposes, and what decides approval, spending, access and delivery is auditable code — not the model's goodwill. This page exists to answer the security questionnaire before it is sent.
The agent answers each person within their role’s reach. Granting and revoking is a management act — revoking interrupts instantly.
Irreversible actions stop and wait for whoever holds the authority. Approvals are signed (HMAC-SHA256) and provable later.
Chained records: tampering invalidates, deleting leaves a mark. History cannot be silently rewritten.
Credentials encrypted in the vault; the code fills the field, only on the true address. The model never sees them.
What goes to the model, what never does, and which model does each task — in writing, not as posture.
A dedicated instance in São Paulo. No shared database across customers — other companies’ data is not there.
What the agent writes executes in an isolated sandbox (gVisor), with no internet by default.
One button freezes all autonomous action. The monthly AI cap blocks on its own when reached.
Signs every navigation (RFC 9421, Ed25519), publishes keys and IPs. Never solves CAPTCHAs, never disguises itself.
Every person has a role, and every role has its reach: what they can ask, see and approve. The agent answers each person within that reach — the same question, asked by different people, respects each one's access. Granting and revoking is a management act, in the Console, instantly; revoking also interrupts whatever the agent was doing on that person's behalf.
Grants of power, approvals and agent actions become chained records: each line is signed, and each line carries the link to the previous one. Tampering with a line invalidates it; deleting a line leaves a mark, because the chain no longer closes. Writes are atomic — concurrent records cannot fork the history. This is auditing in the strong sense: the company's history with its agent cannot be silently rewritten.
A person signs in once, and the credential goes to the company vault, encrypted. From then on, the code fills the password field — directly, and only on the site's true address. The AI model never receives the password; the cloud computer's browser does not store it. Each workstation's access tokens are derived per person (HMAC) — nobody carries a master key around.
What goes to the model: the person's request and the working context needed to fulfil it (the instance's own conversations and files, within the asker's reach). What never goes: passwords and vault credentials. And which model: the best one for each task — conversation, reading files and images, memory and work on the computer each go to the model that does it best, and the bill is real and shows per model in the Console. Nothing the company writes trains a third party's model, and what the house learns belongs to the house — it leaves with the company, if the company wants. Who the vendors are, what each receives and for how long it keeps it is written, name by name, on the privacy and transparency page.
Each company gets its own machine, in São Paulo. There is no shared database across customers: another company's data is not there to leak. And when the agent produces a document, a deck or a site, the code runs in an isolated sandbox (gVisor), with no internet by default — what is born inside only leaves through the delivery door, which goes through people.
One button in the Console freezes all autonomous action in the house, immediately; while the brake is on, the screen says so, persistently — safety you cannot see is not safety. And AI spending has a monthly cap that blocks on its own when reached: the company sets the number, the code enforces it.
EnterDone's agent does not pretend to be human. It presents itself by name in the
User‑Agent (EnterDone-Agent), signs every navigation with Web
Bot Auth (RFC 9421, Ed25519), publishes its keys and egress IP list at public addresses,
and has registrations under way with the agent-verification programs at Cloudflare,
DataDome and Akamai. It never solves CAPTCHAs (it hands control to a person), never works
around blocks, never collects in bulk. The agent's public page has
the technical details and verification addresses.
Every new version of the product passes an evaluation gate before reaching any company: test batteries and behavior proofs — including memory behavior — with the power of veto. If a change would make the agent answer worse, it does not ship.
Researchers and customers reach the people who resolve things:
[email protected]. The address is also
published at /.well-known/security.txt
(RFC 9116). Good-faith reports are welcome and answered.
An AI agent without governance is an intern with the keys to the safe. EnterDone was designed the other way around: walls first, then power. That is what makes it acceptable to give the agent a real computer, the company's credentials and growing autonomy — with the company in control of what it can do, what it spends and what gets recorded.