Security
Effective date: 20 September 2026
Applies to unlimitless.ai and the Unlimitless service at api.unlimitless.ai
This page is the short, plain answer to what happens to your reasoning once it is in Unl. It is written to be checked rather than believed, so where something is not yet true it says so.
What is stored
What you save. The decisions you settle, the reasoning you settle them with, the targets you commit to and the thoughts you keep. That is the whole of it, and it is the product.
Not the data your tools return. When you reach one of your own tools through Unl, the reading travels to your AI in the moment you asked for it. Your criteria are what Unl holds. The reading passes through.
Where it lives
In managed Postgres, in two separate databases that do not reach each other. One holds what you save. The other holds account and usage records, which never touch the first. The handle for the second refuses to open against the first at all, so the separation is a property of the code rather than a habit.
What you save is append-only. A position you change is superseded and the earlier one stays readable, because being able to walk back to what you thought before is the point of keeping it.
Who can read it
Your workspace. Every read and every write carries your workspace identity, and the tables themselves hold policies keyed on that identity, so the scoping is asserted twice by two different mechanisms.
We do not read your content to police it. Nothing you save is scanned, moderated or mined, and nothing you save reaches analytics or error-tracking. Those services see that a save happened, never what was in it.
What never leaves
The keys you hand us for your own tools. They are encrypted at rest with AES-256-GCM. The plaintext exists in the request that saves it and at the moment a read you asked for is signed, and nowhere else. It is never written to a log, never returned in any response after you save it, and it never reaches the model. Removing one destroys the stored ciphertext.
Your reasoning, unless you take it. You can export the whole thing as machine-readable JSON from your portal whenever you like, and you can ask for it to be deleted from the same place. It is yours, and there is no lock-in to make leaving awkward.
The write gate no model can cross
Reads flow freely. Writes do not. Every write to your world carries a single-use token that exists only because you connected in this conversation, and it is checked at one place that every write verb passes through.
So a model cannot decide to write. Neither can a message, a comment, a web page or a tool result that happens to contain instructions. Unl only ever takes in what is reported to it, and it never reaches into a model, an agent or a runtime to inspect or control anything. Those two sentences are the same rule read from both ends.
What is checked, on every change
Each of these runs on every change to the code and blocks the merge if it fails. Each was written to fail first, against the real defect, before its green was trusted.
- A write token is bound to the identity that connected, and another identity cannot spend it.
- A tool call cannot land a write in a workspace other than the caller’s own.
- A retired credential row carries no secret, so removing a key destroys it rather than hiding it.
- Secret-shaped values are masked wherever text is emitted, while ordinary data passes through untouched.
- Nothing that runs in the browser can see a value that was meant for the server.
- A working seat cannot open a writable handle to a live store.
This is not the whole of what a security review would ask, and it is not offered as though it were. It is what is proven today, named so you can hold us to it.
Reporting something
If you find a vulnerability, write to hello@unlimitless.ai with enough detail to reproduce it. A confirmed report interrupts the founder within the hour, whatever else is running.
We will not threaten you for telling us. Give us a reasonable window to fix it before you publish, and we will tell you when it is closed.
What we have not done yet
No independent security review has been commissioned yet. One is on the path, before the product invites an agent into anybody else’s repository, and when it has happened this page will say so with a date. We hold no certifications and claim none.
Unlimitless is early and it is one person plus the machines. That is the honest frame for everything above, and it is why the checks are written to fail first rather than left to care and memory.