The same rules as your staff, written down.

His own account, his own name.

He signs up with his own email address, generates his own password and appears in your product's member list and audit log under his own name, like any other member. He never borrows a person's login, and he acts only as himself.

Where a product has no email sign-up and offers “Sign in with Google”, an owner or administrator can connect a Google account to that one Copyboy. He uses it only to sign in there. We never receive the Google password, and the token Google issues to confirm the address is discarded once the address is read.

Only the tools you put him in, with the rights you gave him.

His access to a product is the invite you sent: the role your administrator chose in that product's own invite form, nothing added by us. He does not wander into software you never added him to. Remove him from a tool the way you would remove a colleague, and that access is gone. Delete the Copyboy and his stored credentials go with him.

He asks before he changes something.

Unless an administrator has switched a Copyboy to autonomous, creating, changing, deleting, sending or paying for anything in another system is a yes-or-no question in the same conversation where the task came from: the comment, the card, the email thread. The question is saved on the task, the work waits for the answer, and the answer covers only the actions the question described.

He stops where a person is needed.

Single sign-on with no email option, hardware keys, phone checks, card details and anything else a product reserves for a person: he does not work around them. The run parks with its browser still open, your administrator gets an email saying which product and why, and an owner or administrator of your company can take over that same browser session from the console, pass the step, and hand it back. Nobody else can.

For the person who invited him, the outcome is simple: he either shows up in the product, or the administrator says why he did not.

What is encrypted, and where.

Passwords, API keys, OAuth tokens and signed-in browser state live in an encrypted vault inside the account's PostgreSQL database, encrypted with a key that is held by the server and never stored next to the data. Nothing is written in plaintext. A key is only ever displayed masked, and a saved secret cannot be read back out of the console.

Each Copyboy runs in its own worker process. The model key behind the included usage never leaves the control plane: a worker receives a short-lived credential scoped to one company and one Copyboy, and the control plane checks the paid seat before every call. The application and the database run on Fly.io in Amsterdam.

Every attempt is on the record.

Every task is a row in the console: who asked and where, what he tried, whether it worked, how long it took and what it cost. Where he used a browser, the recording of that session is attached to the row. Nothing he does is invisible to the account, and administrators see the cost.

What he learns, and who it is shared with.

What a Copyboy learns about your work, your tools and your corrections is stored in encrypted rows in your account, per Copyboy. It is written by his own finished work and by explicit instructions from a person on your team, never copied from a message, a field or an email he read in a system. It never leaves your account.

What he learns about connecting to a product (where the API key lives, which sign-in path works) is a typed fact, not text. Such a fact reaches another company only after two separate companies have found the same value on their own, and every reuse is proved again by a real call before anything is called connected. A share of runs always starts blind, so what is remembered keeps being checked against what is true.

Your data and the model.

The text of a task and the tools he calls are sent to the model provider under that provider's terms. With the included usage, those calls go through our account and the default model; with your own OpenRouter key, through yours and the model you chose. We do not use the content of your tasks to train a model of our own, and we do not sell it.

The included usage has a monthly cap per Copyboy. Before each call the control plane reserves the most that call could cost; a request that cannot fit the remaining amount is stopped rather than billed, and a charge whose outcome is uncertain is never counted as free.

Who runs it, and who else sees what.

Copyboy is operated by Pneumatic Software Inc., Dallas, Texas, the company behind Pneumatic Workflow. The providers that handle parts of the service, from the payment provider to the browser that gets a Copyboy signed up, are listed with what each one sees in the privacy policy; a current list is available on request.

Inside your account, owners and administrators create Copyboys, hold the keys, see the spend and take over a parked session. Members see the Copyboys, give them work and read the record.

What we do not have yet.

No SOC 2 report. No published third-party penetration test. One hosting region. If your procurement needs any of these, write to us and we will say what we have today and when the rest is planned, rather than promise it on this page.