Built so you stay in charge

Encrypted where it sits

Everything in the drive is encrypted on disk.

• Files are encrypted with AES-256-GCM. Separate keys are derived for separate jobs, so the drive, each personal folder and the login vault never share one.
• The drive's key is wrapped for each machine you pair. A new machine receives it during pairing, encrypted for that machine alone.
• Where a machine has a TPM chip, its key can be sealed to the hardware.
• The 12-word recovery phrase never passes through the TPM, so it still works when the board dies or the chip is cleared.

No accounts

The person at the keyboard owns the machine.

• There is no FrameBuff account and no sign-up with anyone.
• FrameBuff listens only to its own machine by default. Anything arriving from elsewhere needs the access token or a paired machine's key.
• On your home network the web page runs over HTTPS, using a certificate authority of the machine's own. You trust it once, by checking its fingerprint on your own screen.

Logins and backups stay sealed

Even the copies you send out are unreadable to whoever stores them.

• Passwords and tokens for other services sit in an encrypted vault. A module only gets the ones you granted it.
• Backups are encrypted before they leave your machine. Your cloud provider stores data it can't read.
• A saved pipeline can't carry a credential, by how it is built rather than by a rule someone has to remember.

Copy it, run it, open your browser

The FrameBuff core is a single program with nothing else to install.

• Linux and Windows desktops and laptops.
• Android phones, through Termux, run the same program.
• Four ways in from the same program: the web page, the command line, the MCP server for AI clients, and the network between your machines.
• Moving a FrameBuff install means copying its data folder. The machine's identity goes with it.

Updates you can check

Your machines only install updates FrameBuff has signed.

• Every release carries an Ed25519 signature, and a machine checks it before installing anything.
• Modules you add from elsewhere wait for your approval before they install.

Contained by default

Agents are useful because they can act. FrameBuff decides where.

• Agents run behind the operating system's own containment, inside limits you set. They never run unconfined.
• They use FrameBuff's tools, so every action shows up as a card you can read.
• An agent's sign-ins live in a home of its own, never in your personal folders.

Nothing irreversible without you

Some actions always wait for a person.

• An unattended run never posts, spends or deletes on its own. Those actions wait on an approval card for you.
• A request nobody answers is a no. A countdown that runs out is a refusal, every time.
• The Rules page shows every rule on the machine, read live from whatever enforces it.

Checked against the real thing

More than 8,500 automated checks, run against real builds.

• Each check starts a real FrameBuff, on its own folder and port, and drives it the way you would: in a browser, over the network, between two whole machines.
• A feature counts as finished only when its check passes against a running program.
• Hardware features are also tried on real machines, such as lending a real graphics card and timing how fast it comes back.