Security

Effective 24 September 2026 · An overview of current controls and their limits.

Accounts and access

Sign-in uses Supabase Auth. Account-scoped API requests require a verified session. Keep access to your email, Google account and device secure. Sign out on shared devices.

Vault and connected services

Vault values are stored with server-side encryption and normally shown to the agent as references. When you authorize an action that needs a secret or connected app, the service may use the value to complete that action. Review an approval request before confirming it. You can remove saved secrets and disconnect apps in the app.

Agent actions

Some actions require your approval or a permission you have configured. Review proposed external writes, purchases and messages carefully. Code and browser work use isolated runtime controls where available; no isolation or automated check is a guarantee against every error or misuse.

Activity and data

The app shows activity for many agent steps so you can review what occurred. AI providers and connected services may receive data needed for a request. See the Privacy Policy for data categories and recipients. Avoid putting unnecessary sensitive information in prompts or files.

Report an issue

Report a suspected security issue to support@belna.se. Include steps to reproduce and avoid emailing passwords, tokens or real secret values. We will review the report and follow up.