more / Security model
Security model
A phone that can run commands on your PC is serious. These are the rules the agent follows.
Who can connect
The phone and the agent each have a key. The agent drops any connection from a key it hasn’t paired before reading a single message. Traffic is end-to-end encrypted with QUIC and TLS 1.3, directly or through a relay that can’t read it.
What a phone may do
Every request is checked against the phone’s current permission: View, Control or Shell. Refusals are written to the audit log. Kills and risky actions ask for Face ID or a fingerprint on the phone first.
The agent never runs as root, and it never enforces paid limits: those live in the app and the push server.
Your data
Stats, logs, job output and actions stay on your machine and phone. Push notifications carry only a short alert text. Report a security issue to security@pocketgpu.app.