AI agent security built into every cron

Human approval before critical steps

Any step can be placed behind an approval gate. By default Crons proposes a gate in front of steps that leave your company: emailing customers, writing to a CRM, posting to public or shared channels. The run pauses, the approver sees the exact output the agent wants to send, and the step continues only after someone clicks approve. Rejected steps are logged with the reason.

• Approvers are chosen per cron, and on Teams you set approval rules per team.
• Pending approvals notify the approver by email or Slack.
• An approval applies to one run, never to future runs.
• Payments are never executed by a cron. An agent can prepare a reconciliation or flag an invoice, but moving money stays with people and your own finance tools.

Read more about how gates work in memory and approvals and in our guide to human approval in AI workflows.

A complete run log for every execution

Every run produces a log with each step, its input, its output, retries and timing. If a step fails, the log shows all three attempts with backoff and the error that ended them. You can open any past run and see exactly what the agent read, what it decided and what it delivered. Dry run mode lets you test a new cron and inspect the full log without sending anything to Slack, Gmail, HubSpot or any other destination.

Failure alerts go to email or Slack so a broken source or an expired token never fails silently for weeks.

Credentials and connected accounts

API keys and tokens you store for HTTP steps are encrypted at rest and are never shown again in full after you save them. Connections to tools like Slack, Gmail, HubSpot, Google Sheets and Notion use OAuth with the narrowest scopes the integration needs. You can revoke a connection at any time from your workspace settings, and you can also revoke it from the connected tool itself. A cron that loses its connection stops at that step and alerts you.

• Credentials are stored per workspace and are not shared between workspaces.
• Code steps (Pro and Teams) run in a sandbox with access only to the inputs you pass in.
• Browser actions run in an isolated headless browser session that ends with the step.
• Traffic between your browser, our service and connected tools is encrypted in transit.

Team access and identity on Teams

Pro workspaces have roles for owner, editor and viewer, so the people who read results do not need permission to change a cron. Teams adds controls that larger companies usually require before rollout.

• SSO with SAML so access follows your identity provider and offboarding is one step.
• Audit log of changes to crons, connections, approvals, members and billing.
• IP allowlist for webhooks so inbound webhook triggers are accepted only from addresses you list.
• Approval rules per team so each department controls its own critical steps.
• Data processing agreement available to sign in the workspace.

See all plan differences on the pricing page.

Uptime SLA and support terms on Teams

Teams comes with a written service level agreement. It covers the web app, the REST API, inbound webhooks and the scheduler that starts your crons, measured per calendar month.

Outages of connected tools (for example a CRM or chat tool that is down) and runs paused by plan limits do not count as downtime. Service credits are requested by email within 30 days of the month in question and are applied as a discount on the next invoice.

How long we keep your data

Cron memory, the data a cron keeps between runs for diffs and deduplication, stays until you clear it or delete the cron. When you close your account, workspace data is deleted after the end of the paid period, subject to the retention rules in our privacy policy.

Your data and model training

AI reasoning steps are processed by our AI model provider under business terms that do not allow customer data sent through the service to be used to train their models. We do not use your crons, run logs or results to train models either. We send only what a step needs to do its job.

Limits that stop runaway agents

Every plan has hard limits on runs per month, AI calls per month and per day, browser minutes and minimum frequency. Crons alerts you at 80 percent of a limit and stops before going over it, so a loop or a bad prompt cannot quietly consume a month of capacity or flood a channel. Deleting a cron does not return usage, which keeps the counters honest within a billing period.

Web fetches and browser actions identify themselves and follow the rules you set. You are responsible for only pointing crons at sites and data you are allowed to access.

Reporting a security issue

If you believe you have found a vulnerability, write to support@crons.ai with a description, the steps to reproduce it and any proof of concept. Please do not access data that is not yours, do not run tests that degrade the service for others and give us reasonable time to fix the issue before sharing details. We reply to every report and keep you updated until it is resolved.