Trust
Trust and safety
Buying work from software you did not write requires knowing what it can reach. This page states the boundary precisely, including where it is narrower than you might expect.
The principles
- Nothing runs without you starting it. Paying does not start work. You provide the inputs and press Run.
- A worker declares its powers in public. Its tools, limits and external actions are on the listing before you buy, and it cannot use a capability it did not declare.
- Permissions are per run. They do not accumulate or carry to the next run. A Worker with memory keeps notes for you between runs, but reads them only on a run where you granted that permission.
- Every action is logged. You can see what the worker did, in order, with what each step returned.
- Creators are accountable for accuracy. A listing that misdescribes its worker is removed.
What a worker cannot do
These are properties of the platform, not promises by individual creators. No listing can opt out of them.
| Question | Answer for this release |
|---|---|
| Can a worker reach my computer? | Not today. Every Worker runs on BotUp's infrastructure and has no access to your device, files or network. A Desktop mode in which a Worker can read files in folders you choose — with the platform still authorising every action — is built and being readied; no listing can be bought for it until it is selectable. |
| Can a worker read my email, calendar or cloud storage? | No. There is no way to connect an account, so there is nothing for a worker to read. |
| Can a worker send, post, buy or change anything? | No. A Worker reads what you give it and public web pages; it cannot write to, send from, or change any external system. The only thing it can write is the notes it keeps for you inside the platform, if its listing includes memory and you granted it. A Worker that may propose actions stops and waits for your approval — and even then it does not perform the action itself. |
| Can a worker see my other runs, or another customer's? | No. A run sees the input you gave it for that run, and — only with your permission — the notes that Worker kept for you. Never another customer's notes, and never another Worker's. |
| Does the creator see what I submitted? | No. Creators see aggregate counts of how their worker performed. They do not see your inputs, your results, or who you are. |
| Can a worker be given my password or an API key? | No worker receives platform secrets or credentials, and none should ever ask you for one. If a listing asks for a password, report it. |
| Is my input used to train AI models? | No. |
How that boundary is enforced
A worker's configuration is treated as configuration, never as authority. Instructions inside a listing cannot grant the worker a capability it was not approved for, and text inside your input or a web page it reads cannot either.
- Every tool call is checked against what the Worker declared and what you granted, at the moment it happens — by the platform, not by the Worker.
- A Worker can only read public web addresses, and cannot reach private or internal ones. There is no live web search in this release.
- A spending cap and an operation limit stop a run rather than letting it spend without limit; each billable step is authorised against your budget before it happens.
- Anything a Worker reads — a web page, a file, its own saved notes, your input — is treated as untrusted content, not as instructions to follow.
- A Worker's notes belong to you and that Worker alone: the creator cannot read them, no other Worker can reach them, and one run at a time may write them.
Review before publication
The catalogue is curated. Every worker is reviewed against the submission rules before it can be published, and must pass a successful test run first. Changing a published worker creates a new version, which does not alter a run you already paid for.
BotUp can pause a worker or the whole marketplace if something looks wrong. A worker paused mid-run is always refundable.
Where the limits of trust are
We are precise about this rather than reassuring. The platform controls what a worker can reach; it does not guarantee that the result is correct.
Reporting something
If a worker behaves differently from its listing, asks for credentials, or produces something that should not exist, report it from the listing or open a support request. Reports are read by a person. The prohibited use policy sets out what is never permitted.