Built for authorized access — and nothing else.
TaskHatch operates real machines you own or are explicitly permitted to control. The design goal is that a reasonable person watching the remote screen always understands what is happening and who is doing it.
Hard boundaries
No hidden or stealth sessions
The companion always shows an active session and the operator's identity. There is no invisible mode.
No credential or secret extraction
TaskHatch never reads password managers, browser credential stores, cookies, or saved secrets.
No security-boundary bypass
We do not defeat UAC, the secure desktop, or OS permission prompts. Elevation is a visible, user-approved step.
No unauthenticated control path
Every relay and cockpit session is brokered with short-lived, HMAC-signed credentials minted by your workspace.
Backups before mutation
File-changing actions back up the target when feasible, so an agent's edits are reversible.
Real providers only
There are no mocked or faked capability providers. If a capability is unavailable on a platform, the agent gets a structured error — not a fabricated success.
Auditing & data handling
Short-lived, signed credentials
Relay and cockpit sessions are brokered with HMAC-signed credentials minted by your workspace and scoped to a single session and role. They expire in minutes.
Per-action audit metadata
Every remote mutation records the actor, action name, session, org, and the policy decision that allowed it. Audit events stream to your workspace, not the relay.
Kill switches
Operators and admins can halt a single session, an organization, or the whole relay instantly. Denied actions are audited with the kill-switch reason.
Data stays where it belongs
Large bytes (screenshots, artifacts, reports) go to your storage bucket; only small structured metadata reaches the workspace. The relay never stores action payloads or media.
Reporting a vulnerability
Found a security issue? We want to hear about it. Email security@taskhatch.co with details and reproduction steps. Please do not open a public issue for security reports.
Visit the help center