1

Sign-in

The web app sends you to WorkOS’s hosted sign-in (email code, Google or Microsoft). WorkOS returns a verified email address to the Claros server, which keeps the session; Claros never sees a password.
2

Agent checks

The guard sends the tool call (and records it reads from the app) to the Claros server. Precise rules run there on the original values, with no model. Before the judge or router calls a model, personal data in the record is redacted on the server (the same rules + PII model as screen text); the originals never leave the server.
3

A person's checks (Claros for Mac)

At a commit moment (Send, Submit, Approve), only the action is sent: the app, the button, the window title, the page address without its query and the field’s text, redacted on the Mac first. Nothing is recorded. See Claros for Mac.
4

Connectors

Decision items from connected tools (or their exports) are stored with their source’s permissions and sent to the model to draft rules (Data sent to models). See Connectors.
5

Storage

Rule sets, the check log, approvals, connector items and the evidence log are stored in the Claros server’s database. The check log stores agent records redacted by default (Check log).

​
Optional: recording rules by voice

Only when someone chooses to record rules by voice over their own screen. Nothing here runs otherwise.
1

In your browser

Claros captures only the window you chose, for the length of the recording. Change detection runs on your device; only keyframes (when the screen settles or something important happens) are sent.
2

Redaction, first thing on the server

OCR reads the frame and personal data is blurred. The raw frame is dropped right after; only the redacted keyframe is kept, with the session log.
3

Model calls

Only redacted frames and OCR text reach the vision model. Screen text is fenced as untrusted data, so instructions on screen are not followed.
4

Voice

Your browser talks to the ElevenLabs voice agent over WebRTC. Final transcripts go to the Claros server.

​
What Claros never sees

  • a continuous recording of your screen or microphone
  • other windows or tabs (when recording by voice)
  • anything said or shown off the record
  • raw video or your face
  • passwords and masked fields
See Subprocessors for every outside service.