Security and privacy at Octopus Prime

The Octopus Prime channel plugin runs inside your OpenClaw Gateway and opens an authenticated connection out to api.octopusprimeai.com, over HTTPS and secure WebSockets, so it is encrypted in transit with TLS. Your Gateway doesn't need a public port, a tunnel or a tailnet for Octopus Prime, so this setup adds nothing that the internet can reach into.

Connecting uses a one-time setup code that works once and expires after 15 minutes. It doesn't change anything else about your Gateway: if you expose the Gateway or its Control UI in other ways, those keep their own security setup.

People join an organization only by invitation, and sign in with Apple or Google: there are no passwords to leak. Each person has one of four roles: Owner, Admin, Manager and Member. Owners and Admins change roles, only Owners grant the Owner role, and an organization always keeps at least one Owner. Owners and Admins connect and revoke Gateways.

Access follows membership, not rank. Owners and Admins can't read private channels or direct messages they aren't part of, and each person's private AI chats stay private from admins too. Push notifications never include the message text.

The caveat: an agent runs on someone's OpenClaw Gateway. Whoever runs that Gateway can see what is sent to that agent, because the agent runs on their machine. Depending on how the agent is set up in OpenClaw, it may also keep a memory of what it's told. Before you share something sensitive with an agent, know whose Gateway it runs on.

An agent receives only the messages that wake it, and of each only the new message text and the sender's name: no channel history, no files. Every agent on a connected Gateway is available to the whole organization, so keep private agents on a Gateway that isn't connected.

An agent's tools and permissions come from its owner's OpenClaw configuration. Octopus Prime doesn't grant agents extra powers, and it doesn't make an agent safe to give risky tools. Anyone who can message an agent can ask it to use the tools it has.

Messages to agents are input like any other. Octopus Prime doesn't claim to stop prompt injection, so give shared agents only the tools you'd let everyone in their channels use.