One tenant token
The bearer token scopes MCP and API actions to one isolated tenant. The full token is shown once and stored as a hash server-side.
Trust by inspectable boundaries
Agent-operated. Server-governed.
Coldrig gives an agent useful authority inside one tenant while keeping essential safety rules below the model layer. This is the current trust model—not a certification claim.
Control layers
Four boundaries that matter.
A trustworthy agent product cannot rely on a good prompt alone. Identity, isolation, spend, and sending behavior need deterministic enforcement and human visibility.
Browser session
The dashboard exchanges a valid tenant token for an HTTP-only browser session, avoiding routine token exposure to page scripts.
Server guardrails
Suppression, stop-on-reply, limits, idempotency, and health-based state transitions are service rules, not agent promises.
Scoped data paths
Dashboard and tool requests resolve through authenticated tenant context. Customers do not share a sender reputation pool.
Visible control
The owner sees health, campaigns, replies, setup, and billing projections. Self-serve billing (Stripe live mode) is active — $49/mo platform plus $10/mailbox — and every real vendor-spend call is atomically reserved against a monthly spend ceiling on the vendor account before it's allowed to run — reserved first, not just logged after the fact.
No hidden claims
Known gaps stay visible: real-send activation still needs mailbox send-authorization completing on our side after provisioning (not fully automatic end-to-end), no readable token recovery, and no compliance certification claim.
Your responsibilities
Secure the credential. Govern the agent.
- Keep tokens out of source controlUse a password manager or client-level secret environment.
- Review tool accessInspect the 28 available tools before approving write actions.
- Use the sandbox firstThe free sandbox has no card on file, cannot spend, and cannot send — test failure handling and idempotency there before you activate real sending on your own account.
- Rotate after suspected exposureTokens are not recoverable in plaintext; contact support for the current rotation path.
Responsible disclosure
Report privately.
Email [email protected] with impact, reproduction steps, and a safe proof. Do not access other tenants, run destructive tests, or include live secrets. We do not yet publish a bounty or guaranteed response SLA. If that address bounces, open a minimal, non-sensitive GitHub issue asking for a private contact path.