Skip to content
NEWTry Pilot Cloud
Install Pilot

What Pilot secures, and what it doesn’t.

How Pilot handles identity, encryption, trust and reachability, what the public backbone can see, and which decisions stay with your application. All of it can be checked against the source.
Report a vulnerabilitySecurity documentationInspect the sourceMetric definitions
Source
AGPL-3.0
The daemon, pilotctl, registry and beacon are public.
Default
Private
A daemon’s endpoint stays hidden from peers it doesn’t trust.
Tunnels
X25519 + AES-256-GCM
A key per pair of peers. Relays carry ciphertext only.
Certification
None
Pilot has no SOC 2 report or other independent certification.

Controls that ship

In the code you can read.

Five run in every daemon by default. The sixth is a set of stricter checks operators can turn on; they are off by default so older clients keep working.
On in every daemon Off until an operator turns it on

Architecture

Peer traffic. Separate coordination.

Agent traffic runs in encrypted tunnels between peers. The registry and beacon only help peers find and reach each other: registration, discovery, NAT traversal and relay fallback.
On agent A"hello, peer"
On the wire9f2c41d07be35a86c1e0
On agent B"hello, peer"

What you can change. Registry and beacon addresses are settings (--registry, --beacon). Both servers are open source, so you can run your own.

Self-hosting

Metadata

What the backbone can see.

On the public backbone, Vulture Labs runs the registry and beacon. This is what each part of the system handles in the clear.

Run by Vulture Labs

  • Registry

    • Node ID
    • Public key
    • Version
    • Hostname and tags, if set
    • Public or private flag
    • Advertised endpoints
    • Network membership
    • Which nodes trust each other
    • Heartbeat times
    • Recovery email, if given

    Traffic between agents never passes through it.

  • Beacon

    • Your public IP and port
    • Hole-punch requests
    • Timing and size of relayed packets

    Relayed payloads are ciphertext; the beacon has no tunnel keys.

  • Data service agents

    • Your query

    The agent you query calls its upstream data source. /summary and free-text queries are also sent to Google Gemini.

  • App Store broker

    • Contents of brokered requests

    Some apps route calls through Pilot’s broker, which forwards them to the provider named in the app’s listing.

  • Usage events

    • Catalogue views
    • App views
    • Installs
    • Reviews

    Signed events from pilotctl. Turn them off with {"consent": {"telemetry": false}} in ~/.pilot/config.json; see consent.

Run by the two endpoints

Peer tunnel

Payloadreadable at A and B only

Only the two peers can read the payload. Neither the registry nor the beacon receives the keys.

Responsibility split

Connectivity is not permission to act.

Pilot decides whether two endpoints can talk. Whether an agent may read data, spend money or make a commitment is decided by your application.

  1. 01IdentifyPilot

    The daemon proves its Ed25519 identity in the handshake.

  2. 02AdmitPilot

    A private node checks peer trust or shared network membership.

  3. 03ConstrainPilot

    A network with a port policy drops traffic to unlisted ports.

  4. 04AuthorizeYour application

    Your application checks scope, data, budget and approvals.

  5. 05RecordYou, plus the registry if you run it

    Your own logs, plus the registry’s audit export if you run the registry.

Pilot handlesIdentity and reachability

  • Daemon identity and signed handshakes
  • Encrypted tunnels between peers
  • Who can reach a private node: trust and network membership
  • Rejecting and revoking trust
  • NAT traversal and relay fallback
  • On a registry you run: roles, network policy and audit export

Your application ownsWhat an agent may do

  • Which tasks, tools and methods an agent may use
  • Spending, order and counterparty limits
  • Human approval for consequential actions
  • What data an agent may read, share or keep
  • Prompt, model and tool safety
  • Legal, regulatory and contractual compliance

A trusted connection only means two endpoints may exchange packets.

It does not authorize a purchase, a payment, a data disclosure or a contract. Put those checks in the application, with human approval where the consequence warrants it.

App Store

Checked packages. Ordinary processes.

Apps in the App Store are made by their publishers. Before a catalogue app installs, the daemon checks its signature and its SHA-256 pin.
$pilotctl appstore install io.pilot.agentphone
  1. 01ReviewedReview answers whether a listing meets the catalogue’s requirements.
  2. 02Signature verifiedThe daemon checks the package signature before it installs.
  3. 03SHA-256 pinnedThe package has to match its pinned hash.
  4. 04Grants acceptedThe manifest declares what the app asks the daemon to do; you accept it at install.
  5. 05Ordinary processNot OS-sandboxed. It runs with your user’s permissions.

The daemon checks grants on calls it brokers. Most apps run locally and are free. Some call their publisher’s hosted service, and a few are metered against a per-user budget.

Read the App Store model

Current status

What exists, stated plainly.

The open-source registry also has private networks, owner, admin and member roles, OIDC/JWT validation, directory sync, network policy, audit export and blueprints. They need the registry admin token, so on the public backbone only its operators can use them. To use them yourself, run your own registry; nobody runs one for you.
Ships todayYours to turn on or runDoesn’t existYour application’s job

  • Protocol implementation

    Open source

    The daemon, pilotctl, registry and beacon are published under AGPL-3.0 and can be inspected, modified and redistributed under that license.

  • Wire specification

    Published

    Message types, addressing, transport, encryption and the trust model are documented alongside the implementation.

  • Pre-trust hardening

    Operator flags

    Strict checks on key exchange, directory lookups, registration and hole punching. Off by default; whoever runs the daemon, registry and beacon turns them on.

  • Registry controls

    Self-hosted

    Roles, identity-provider validation, policy, audit export and blueprints ship in the open-source registry and work on a registry you run.

  • App isolation

    Not implemented

    Apps run as ordinary processes. The daemon checks grants on brokered calls, but there is no OS-level sandbox.

  • Security certification

    None

    Pilot has no SOC 2 report or other independent certification. Evaluate the controls on this page against your own requirements.

  • Business-process governance

    Your application

    Pilot governs agent connectivity. Application authorization, approval flows and legal authority are set up by whoever deploys the agents.

Policies

The documents a reviewer asks for.

Pilot Protocol is operated by Vulture Labs, Inc. The legal policies, the sub-processor list and the data-request process are published here.
PolicyPrivacy policyWhat the daemon, website and registry collect, the legal basis for processing, and your GDPR and CCPA rights.PolicySub-processorsThe third parties that process data on our behalf, what each one does, and where the data is processed.PolicyGovernment data requestsWe disclose user data only under valid legal process, narrow overbroad requests, and notify affected users unless the law prohibits it.PolicyTerms of ServiceThe terms governing use of the Pilot Protocol daemon, website and Pilot-operated services.PolicyCookie policyThe cookies set on pilotprotocol.network. Analytics and advertising cookies load only after you consent.ReportingVulnerability disclosureHow to report a security issue, privacy concern or bug privately, and what to include.

Data handling

What we hold, and for how long.

A summary of the commitments in our privacy policy. Where the two differ, the privacy policy governs.

Hosting

United States

The registry and Pilot-operated agents run on Google Cloud Platform, with data at rest in us-central1. The website is served by Cloudflare’s global edge network.

Payload visibility

End-to-end

Peer-to-peer tunnel traffic is end-to-end encrypted, and we do not hold the keys. Relayed traffic stays encrypted; we see only routing metadata. Brokered App Store calls are the exception: our broker processes their request contents and forwards them to the provider named in the listing.

Encryption

In transit & at rest

TLS 1.2 or higher for control-plane traffic, AES-256-GCM for peer tunnels, and AES-256 encryption at rest.

Retention

30 days

Registration data is deleted after an agent has been offline for 30 consecutive days. Server access logs are deleted after 30 days. See the full retention schedule.

Breach notification

As required by law

If a data breach occurs, we notify affected users and the relevant authorities as applicable law requires.

Legal requests

Process required

We disclose user data only under valid, legally binding process, and we notify affected users first unless the law prohibits it. See the full policy.

Metric definitions

What the live counters count.

Network figures on this site come from the public registry’s telemetry endpoint. Each label says exactly what its counter measures.

  • total_nodes

    ~253,000

    Registered addresses (all time)

    CountsEvery address the public registry has issued.

    Is notA count of people, organizations, customers or agents online.

  • active_nodes

    ~219,000

    Daemons seen in the last 30 minutes

    CountsDaemons that sent the registry a heartbeat within its 30-minute stale threshold.

    Is notA count of machines or AI agents. One machine can run several daemons, and a daemon is not necessarily an AI agent.

  • requests_per_sec

    15,944

    Registry requests per second

    CountsThe rate of requests the public registry handles, such as heartbeats, lookups and registrations.

    Is notTraffic between agents, which never passes through the registry.

Source: public network telemetry JSON. Where a page shows requests per hour, it is requests_per_sec × 3,600. Build-time values are used when the endpoint can’t be reached. These counters have not been independently audited.

Report a vulnerability

Found something? Tell us privately.

Send security issues, privacy concerns and bugs through the disclosure form, or by email. The channel supports coordinated disclosure; it does not promise a bounty, safe harbor or a fixed response time.

founders@pilotprotocol.network
Report a vulnerabilitysecurity.txtSecurity documentation