Security model
Your account
Section titled “Your account”Your own account is non-custodial. Its keys are yours: created on your device when you sign in with Google, or held by the wallet you connect. Every transaction from it is approved by you. Lotvs prepares transactions and shows you what they do, and cannot move your money.
Before your wallet is asked to approve anything, Lotvs simulates the transaction, so one that would fail never reaches you.
An agent’s account
Section titled “An agent’s account”An agent never holds a key and never sees an address. It asks Lotvs to act, and Lotvs carries the action out on its servers only after every rule has passed.
| Protection | What it does |
|---|---|
| Separate account | A connection is one agent with one account. It cannot see or touch yours, or another agent’s |
| Funded only by you | Nothing from outside can be put in an agent’s account. It has no address to receive money |
| Rules on the server | Every limit and switch is checked by Lotvs before anything is signed. An agent cannot raise or skip one |
| One write for limits | The daily limit, the balance and the hold are checked in one write, so two calls at once cannot both pass |
| Known destinations only | Transfers go to you or to people you allowed. An address found in a web page, an invoice or a message is refused |
| Asking | Above an amount you choose, a payment waits for your yes |
| Automatic pause | Four actions stopped by your rules within five minutes pause the agent |
| A full record | Every attempt, allowed or stopped, is written down with the checks and the agent’s reason |
| Instant revocation | Disconnecting kills the agent’s token or access key at once |
Defending against prompt injection
Section titled “Defending against prompt injection”Agents read web pages, emails and API responses that may try to give them orders. Lotvs assumes this will happen:
- A destination that does not come from your own list is refused, whatever the agent was told.
pay_x402pays only the price the site states, up to themax_usdcthe agent named and inside your limits.- Tool results tell the agent that a site’s response is content, not instructions.
- A burst of refused attempts pauses the agent.
Access tokens
Section titled “Access tokens”OAuth access tokens last one hour and refresh tokens 90 days, rotated on every use, and both are bound to the Lotvs MCP endpoint. See Authentication.