Does Latchkey send my keys to the cloud?

No. Secrets are encrypted on your device with libsodium secretbox. The website handles accounts, billing, and licence delivery, never vault plaintext.

How is encryption implemented?

Vault entries use libsodium secretbox (XSalsa20-Poly1305). The master key prefers the OS keychain via keytar, with an Argon2id passphrase wrap as fallback.

Can an AI agent read every key?

Only names listed in that project’s .latchkey.toml can be requested. Each request still needs your approve or deny in the app or CLI.

Is the leak scan free?

Yes. npx @stitchaxis/latchkey scan runs offline on your machine, with no licence and no account. Paid plans start at £4.99 a month for the vault and approvals.

What is the leak scan?

A free offline pass over a repo or pasted text that looks for exposed key shapes, then gives step-by-step rotation guidance. It does not upload your files.

How do MCP tools get a secret?

The Latchkey MCP server exposes a get-secret tool. Your agent requests a name; you approve or deny; the value is returned only on approve and an audit line is written.

What does the audit log contain?

Metadata only: timestamp, action, secret name, agent or process label, and decision. Secret values are never written to the audit log.

What is .latchkey.toml?

A per-project allowlist of environment variable names Latchkey may inject. Commit the file; keep values out of git.

Which platforms does the CLI support?

macOS, Windows, and Linux with Node.js 20+. Keychain backends are Keychain, Credential Manager, and Secret Service respectively.

How do licences work?

After checkout, Latchkey issues an Ed25519-signed licence token. Activate it with latchkey login. The CLI verifies the signature offline with a bundled public key.

What do you never see?

We never receive vault plaintext, master keys, or passphrase material. Servers may store account email, plan entitlements, device metadata, and audit metadata you choose to sync, not secret values.

Who do I contact for Enterprise or support?

Email Yusuf@yusuf-choudhury.com. Business plan includes priority email support within one business day.

← Latchkey

What we're building next

Latchkey ships today. These are next. Join the list for the ones you want; we only email about that product.

Guide cloud → full agent
Latch Agent
Works alongside Cursor, Claude, ChatGPT, and other AI chats. Latch explains Latchkey vault, approvals, and MCP without replacing your IDE assistant. Waitlist for a deeper agent tied to your workspace.
Join waitlist
Security pass for agents & repos
Latch Check
Scans for risky tool configs, secret-shaped strings, and MCP scope issues, complements the approve gate (the OpenAI / Hugging Face class of mistakes).
Join waitlist
AI-written code review
VibeCheck
Static passes and dependency nudges before merge, separate SKU from Latch Check, same waitlist plumbing.
Join waitlist
Clean files before they reach an AI
Latchkey Scrub
Removes personal details and secrets from files and text on your own computer before you paste them into ChatGPT, Claude, Grok or Gemini. Offline, no account.
Join waitlist
Your bank statements, understood offline
Books PFE
A personal finance engine that reads your statement files on your own device and explains where the money goes. No bank login needed.
Join waitlist
Your details stay on your devices
Personal-data layer
A browser layer that warns you before your own personal details are pasted into an AI chat, and swaps them for placeholders.
Join waitlist
Show what reached an AI and what did not
Compliance layer
Team policies and a counts-only audit trail for finance, health, legal and education teams. Not a certification.
Join waitlist

← Latchkey

What we're building next

Latchkey ships today. These are next. Join the list for the ones you want; we only email about that product.

Guide cloud → full agent
Latch Agent
Works alongside Cursor, Claude, ChatGPT, and other AI chats. Latch explains Latchkey vault, approvals, and MCP without replacing your IDE assistant. Waitlist for a deeper agent tied to your workspace.
Join waitlist
Security pass for agents & repos
Latch Check
Scans for risky tool configs, secret-shaped strings, and MCP scope issues, complements the approve gate (the OpenAI / Hugging Face class of mistakes).
Join waitlist
AI-written code review
VibeCheck
Static passes and dependency nudges before merge, separate SKU from Latch Check, same waitlist plumbing.
Join waitlist
Clean files before they reach an AI
Latchkey Scrub
Removes personal details and secrets from files and text on your own computer before you paste them into ChatGPT, Claude, Grok or Gemini. Offline, no account.
Join waitlist
Your bank statements, understood offline
Books PFE
A personal finance engine that reads your statement files on your own device and explains where the money goes. No bank login needed.
Join waitlist
Your details stay on your devices
Personal-data layer
A browser layer that warns you before your own personal details are pasted into an AI chat, and swaps them for placeholders.
Join waitlist
Show what reached an AI and what did not
Compliance layer
Team policies and a counts-only audit trail for finance, health, legal and education teams. Not a certification.
Join waitlist