Security

How Coceyo is built

Local first: your workspace lives on your devices by default, and cloud sync is optional and hosted in the European Union.

Encryption: data is encrypted in transit and at rest; traffic between your phone and your computer is end-to-end encrypted.

Approvals: agents cannot send, publish, spend, delete or change permissions without your approval, and they cannot raise their own permissions.

Audit log: every action is recorded in an append-only, tamper-evident log written by the system, not by the AI.

Least privilege: each agent only accesses the tools and data you grant to its role.

Report a vulnerability

If you believe you have found a security vulnerability in Coceyo, email contact@mindzy.me with “Security” in the subject. Include a description, the steps to reproduce it and its possible impact. We will acknowledge your report within 5 business days and keep you informed until it is resolved.

Rules for security research

Act in good faith: only test your own account and data, do not access, modify or delete other people’s data, do not degrade the Services (no denial-of-service or spam), and give us reasonable time to fix the issue before disclosing it. We will not take legal action against research that follows these rules.

Certifications

Coceyo is designed for GDPR compliance. We do not claim any security certification until it has been independently audited.