Keystile Cloud
We host it for you. Available on request for teams that prefer it.
Control for AI agents with access to your systems
Control what your AI agents send, change and pay.
Your agents are logged into email, CRM, client records and admin tools. Keystile checks every action before it runs: client data leaving the firm, instructions hidden in a web page or email, a risky change, a payment. It decides in real time: allow, mask the private data, hold it for a person, or block it. Every decision goes into a signed record auditors can verify.
Example · agent actions checked by Keystile
Email client statement to outside address
REDACTAccount numbers removed before sending
Export the CRM's contact list, as a web page instructed
BLOCKBulk export of client records, after reading hidden instructions
Grant a new user admin rights
ESCALATEAccess change, waits for a person
Send $40,000 to new payee
ESCALATENew payee, far above normal, after hours
0 / 35attacks ran on their own in our test on a public attack suite
1 clickto approve or reject a held action, recorded with who and why
Your serversclient data stays inside your walls
Patentpending since early 2026
Demo · 4 minutes
Watch Keystile stop a hijacked AI agent.
Demo video
Coming this week.
Meanwhile, try the live scenarios below. They show real verdicts from Keystile.
Try it yourselfTest report · 7 October 2026
No attack ran on its own: 27 blocked, 8 held for a person.
Our own test, on a public set of 56 cases written by an outside open-source project: 35 attacks, 16 harmless actions and 5 borderline ones. Every attack was blocked, masked or held for a person before it could run. Held means a person had to approve it, so the approval step is part of the protection. One harmless action was held; none was blocked.
27attacks blocked or masked outright
8attacks held for a person to decide
0attacks let through
15 / 16harmless actions let through, none blocked
| What the test tried | Cases | Blocked or masked | Held for a person | Let through |
|---|---|---|---|---|
| Sending private data or files out | 10 | 9 | 1 | 0 |
| Destroying data, systems or access | 7 | 1 | 6 | 0 |
| Hidden instructions in an agent's request | 4 | 4 | 0 | 0 |
| Stealing passwords and keys | 3 | 2 | 1 | 0 |
| Hidden instructions in what a tool returns | 6 | 6 | 0 | 0 |
| Secrets in what a tool returns (masked) | 3 | 3 | 0 | 0 |
| Attacks hidden deep in very long text | 2 | 2 | 0 | 0 |
| All attacks | 35 | 27 | 8 | 0 |
| Other cases | Cases | Result |
|---|---|---|
| Harmless actions and tool outputs | 16 | 15 let through, 1 held for a person (an invoice email), none blocked |
| Borderline cases | 5 | 2 held for a person, 2 blocked, 1 masked |
| Tool descriptions with hidden instructions | 3 | 2 flagged, 1 missed. Description screening is a separate check; the tool's actions are still checked when the agent uses it |
| Harmless tool descriptions | 2 | 2 let through |
| Speed per check | 56 | Median 0.9 seconds, 95% under 4.5 seconds, on the default Balanced setting with the decision model. Fixed rules (amount caps, allowed recipients, spending limits) answer in milliseconds |
This is our own evaluation, not an independent audit. Run three times on 7 October 2026 (55 of 56 cases decided the same way every time) with the built-in rule packs and default settings, on our own decision model. We used this test set while building Keystile's checks, so a fresh, held-out set is next; we will publish those results here too. Full case-by-case results are available to pilot customers.
The problem
AI agents now hold real keys. Nothing independent checks what they do with them.
On 11 March 2026 an attacker used one compromised admin account and a normal device-management command to wipe about 80,000 devices at Stryker in three hours. No malware. Every command was authorized. Now picture the same access in the hands of an AI agent, steered by a prompt injection instead of a stolen password.
Step 1
One admin account compromised
Step 2
New global admin created
05:00–08:00 UTC
Normal wipe command, at scale
Result
~80,000 devices erased
Agents are everywhere
Always-on agents from OpenAI, Microsoft, Google and Salesforce now act with their own credentials. Gartner expects 15% of day-to-day work decisions to be made by agents by 2028.
Today's checks miss it
Antivirus sees no malware. Access control sees valid credentials. Per-action rules see a normal command. The danger is in the pattern.
Regulators want proof
Financial firms must show which model decided, that it was not altered, and why. New SEC breach rules for advisers add a 30-day clock.
Sources: BleepingComputer · Gartner via WFTV · TechCrunch
Try it yourself
Pick what an AI agent is about to do.
Each scenario shows the action the agent submits, Keystile's checks, and the verdict it returned.
What the agent submits
Keystile is checking
- Reading the action
- Checking your rules
- Looking for client data
- Comparing with this agent's normal behavior
- Signing the decision
Sample scenarios. Verdicts, confidence and decision times were recorded from Keystile in October 2026.
How you use it
Connect it once. Write rules in plain English. Every agent action gets checked.
01 · CONNECT
Sit in front of your agents
Keystile goes between your AI agents and the tools they use: payments, email, client data, admin consoles. One line in Python, LangChain or the OpenAI Agents SDK; one setting for MCP; one command for Claude Code, Cursor or Hermes Agent; or the API from any language.
02 · SET RULES
Say it in plain English
"Payments over $10k to a new payee need a human." "Client account numbers never leave the firm."
03 · DECIDE
Allow, redact, escalate or block
Each action gets a verdict in real time, with the reason. Anything high-stakes waits for a person.
04 · PROVE
A signed record of every decision
Compliance and auditors see what was checked, what was decided and why.
Products
Measure first. Enforce when the numbers are right.
Available now
Keystile Replay
Send us a few weeks of agent logs and your policies. We show every action Keystile would have allowed, held or stopped, and why, and we flag the cases your logs can't settle. Nothing to install.
Available now
Shadow mode
Keystile runs beside one agent workflow and records what it would decide, without blocking anything. You see the false alarms and the added time before you turn enforcement on.
Available for pilots
Keystile Gateway
Live protection on your own servers or run by us in your cloud. The MCP gateway and the system gateway sit outside the agent, so it can't skip them; if Keystile can't be reached, the action is refused. Agents can't approve their own held actions. PATENT PENDING
For developers
No server to run. An address, a key, and one line.
Your admin runs Keystile on your own servers, or we run it for you. Developers get two settings and connect the same way, whichever it is.
# pip install keystile · KEYSTILE_URL and KEYSTILE_API_KEY come from your console
from keystile.client import KeystileClient, guard
ks = KeystileClient()
@guard(ks, agent_id="payments-agent") # checked before every call
def send_payment(payee: str, amount: float): ...
Self-hosted
Your IT team runs the Keystile server on your own servers or cloud account, under a license. Client data never leaves you.
Managed
We run Keystile for you, inside your own cloud account. Client data still never leaves you.
Plans
Start free. Prove it on your own logs. Then pay to protect something real.
Pro
$50 a month
Builders and small teams
- Keystile AI platform: 700+ app integrations, one key for Claude and Cursor
- Every action checked by Keystile Intelligence
- 3 agents, 25,000 checks a month
- Start free, then upgrade
Pilot
$2,500 to start
Replay assessment on your logs, then a 90-day pilot ($7,500)
- One workflow, shadow mode then enforcement
- Results reported every two weeks
- Fees credited to your first year
Team
$500 a month
Fintechs and IT teams in production
- 10 agents, 250,000 checks a month
- Console, approvals, signed record
- Extra checks $1 per 1,000
Enterprise
From $50k a year
Banks, wealth managers, credit unions
- On your own servers, offline option
- Named approvers, audit export
- Scoped onboarding and support terms
A check is one action or tool output Keystile evaluates. Pro runs on the hosted Keystile platform. Team and Enterprise run on your own servers under a license agreement, or we run Keystile for you in your cloud account (quoted separately). Education and nonprofits: 40% off.
Early access
Join the waitlist.
We are letting people in a few at a time, so every team gets set up properly.
- Tell us about your agents.
- We send you an invitation by email.
- Sign in with your email (no password), create an API key, and protect your first agent on the free Developer plan.
You're on the list.
Thank you. We'll email you an invitation as soon as your spot opens.
Who it's for
For teams whose AI agents can read client data, change systems or move money.
Wealth managers, banks and fintechs
Client-service and advisor assistants that draft emails and pull records. Account and Social Security numbers stay inside the firm, hidden instructions in emails are withheld, and the signed record is ready for examiners and your customers' security reviews.
IT teams and managed service providers
Agents that reset passwords, change access and manage devices. Routine work flows through; new admins, mass wipes and security changes stop or wait.
As agents start moving money
New payees, large amounts and bank-detail changes wait for a person, and approvals apply to the exact payment. The same Keystile you already run.
Team
Built by someone who ran payment systems inside wealth management.
Live AI Dream
The team behind Keystile
- VP of Software, Payment Systems, LPL Financial. Learned the exact nuances of wealth management from the inside and saw its pain points first-hand.
- AI and edge devices at Qualcomm, Nokia and Intel. Built intelligence that runs on the device itself, where speed and trust matter most. Several granted patents worldwide.
- Five US patent-pending applications in AI security.
Pilot program
We are taking three pilot customers this quarter.
You get
A Replay report on your own logs, then one agent workflow in shadow mode and under enforcement, set up with you, with the numbers every two weeks: violations found, false alarms, added time.
The cost
$2,500 for the Replay assessment, then $7,500 for the 90-day pilot. Both are credited to your first year if you continue.
Your data
Covered by a mutual NDA. Anonymized logs are fine to start; live checks run in your own environment.
contact@keystile.com
Email us