LAUNCH VERSION · 19 SEPTEMBER 2026
Security architecture
LA CLÉ security is based on verifiable limits, non-recoverable secrets, human approval, and immediate revocation.
Authentication
The personal account uses the identity supplied after ChatGPT sign-in. Access decisions are checked on the server.
Secrets
Mandate tokens contain 256 random bits and are hashed before storage. Public proof codes use a separate value and grant no right to act.
Google connection
LA CLÉ uses OAuth 2.0 with a single-use state value to prevent sign-in redirection attacks. Google tokens are encrypted at rest with AES-GCM, and the requested Gmail permission is limited to sending email.
Budget caps
An authorized amount is deducted using an atomic conditional update. Two concurrent requests cannot exceed the remaining budget.
Requests
Each operation uses an idempotency identifier to prevent duplicate deductions. Prohibited actions and data scopes are checked on the server, and the API applies per-token rate limits.
Human confirmation
A mandate may require an explicit decision by its owner. The request then remains pending, and the agent receives no authorization before approval.
Integrated AI assistant
The AI model prepares only a structured proposal. It never receives secret tokens and cannot bypass deterministic server checks, mandate status, or required human confirmation.
Action integrity
An approved action preserves its account, recipients, content, schedule, and attendees. Any material change must create a new authorization request.
Single Gmail send
An atomic update reserves the action before Gmail is called, preventing concurrent duplicate sends. After an ambiguous network error, LA CLÉ blocks automatic retries and asks the user to check Sent messages.
Revocation
Revocation immediately changes the mandate status. Every new request using that mandate token is then refused.
Pilot scope
The service has not yet received banking certification, an independent security audit, or eIDAS qualification. Those steps are required before regulated use.
Report an issue
Report a vulnerability or suspicious activity to contact@la-cle.app with reproduction steps and without attaching a secret, password, API key, or complete token.
Questions? Contact LA CLÉ support.