Your code, your machines, your keys

No. ace runs each agent through its own logged-in CLI, so your existing subscriptions and logins keep working. ace never asks for, stores or proxies provider credentials.

ace runs on your own machines; your agents and code never run on our servers. Your code goes only where your agent CLI already sends it. Devices reach your machines directly over your local network or Tailscale, or through ace's relay, which is end-to-end encrypted and can't read what it forwards. You can also host the relay yourself.

The agent's own CLI, in the permission mode you chose for it. ace adds no approval layer of its own and never answers an approval for you.

Only devices you pair, with the access you choose (view only, or view and act, for as long as you set), and devices signed in to your ace account. A machine code makes even those enter a PIN or password before they get in. Each machine also decides how much other linked machines may do on it.

The addresses and timing of a connection and the size of its encrypted messages. Traffic between your devices and your machines is end-to-end encrypted, so the relay can't read prompts, code or screens, and it keeps nothing after the connection ends.