You can save a website login on your Motif page so the assistant can sign in for you. This page says, in plain words, what happens to that password and what Motif promises about it. The short version: the assistant never sees it, nobody at Motif can read it, and every use of it is written down for you. Questions: hello@heymotif.ai.
Where the password goes
- You type it on your Motif page, over an encrypted connection, never in the chat. If a password does end up in the chat, the assistant tells you so and asks you to change it; it is not kept and the assistant never types a password it read in a message.
- It is sealed at once with a key made for that one value, which is itself locked with a key that lives in Google Cloud's key service and never leaves it. The service that saves your login can only lock; it cannot unlock. Only the service that fills the password into the website can.
- The name you give the login and the website it is for are sealed too. A copy of our database says of nobody which sites they have accounts on.
How the assistant signs in
- The assistant does not get your password. It asks a separate program, which runs the browser, to fill the sign-in form. That program types the password into the website's own form and nothing else, and clears it from the page afterwards.
- It fills only on the website you saved the login for. A page that sends the assistant somewhere else to sign in, a form that would send the password to another address, and a form inside a frame from another site are all refused.
- The first time a login is used on a site, you are asked in WhatsApp, with the site and what the task was for in your own words. You can turn that question off for all your logins on your Motif page; it is off by default.
- Every sign-in is named in the assistant's reply, written by our systems and not by the assistant, so no page can keep one quiet. Your Motif page shows the history of each login: when, where, what was filled.
- Changing an email address, phone number, address, password or payment method on a signed-in site waits for your tap, even when the task is about that site. The one exception is a change you asked for yourself, in your own words, naming the site and what to change: that change goes ahead, and nothing beyond it does.
What the assistant cannot do
- Read the password back from the page, in any way we have found: not through a Show button, a screenshot, the page's code, a copy and paste, or a page that echoes it. We test this against a real browser on every change.
- Type the password anywhere but the website's own sign-in form, or send it to another address.
- Keep it in its memory, say it in the chat, or store it in a file.
What our operators cannot do
- No operator tool shows a password, a username, a login's name or its website, and no route in our systems can reveal a password to a person. This is not a setting that can be changed by an operator; it is how the keys are held.
- Who may unlock a login's key is set in code and reviewed; a change to it raises an alert. No person holds that permission.
- Unusual use (many unlocks in an hour, many refused sign-ins, many sign-ins in a day) raises an alert we look at.
Your controls
- Change or remove any login on your Motif page. Removing one also signs the assistant out of that site at its next turn.
- The panic button removes every login at once, signs out of every site and forgets the browser's saved sessions. Our backups keep sealed copies for up to 30 days, which only the service that fills passwords can open, and then they are gone too.
- When you save a password, your browser checks it against Have I Been Pwned's list of breached passwords, without the password or its hash leaving your browser (only the first five characters of its hash are sent), and warns you if it appears there. You can save it anyway.
- For a bank or your mailbox, we suggest saving the password without the authenticator key, so a code is still yours to enter: the assistant then hands you the page when one is needed.
What we would tell you
If we ever had reason to believe a login's key or the service that fills passwords was in the wrong hands, we would tell the customers affected which logins were involved and when they were used, in plain words, so you can change those passwords. The privacy notice has the rest of our commitments.