A marketplace built so your data - and your bill - stay yours
The Writ Marketplace is designed around one idea: you install a recipe, attach your own data, and run it on your own account. Here's how each safeguard works, and where each one stops.
Six safeguards on every listing
Each is enforced by the platform, not promised by a creator.
Your data stays yours, end to end
A listing is a recipe - steps plus a manifest of required inputs. The creator's personas, credentials, secrets, and sessions are stripped at publish, so what you install can never contain them. On every run, the workflow resolves only the data you attached.
Stripped at publish
- Creator credentialsRemoved before the recipe is shipped.
- Creator sessionsNever part of what you install.
- Embedded secretsBlocked at publish until parameterized.
Resolved on your run
- Your persona / login: Your own authorized account.
- Your vault secret: Referenced from your vault only.
- Your input values: Validated against any per-input regex rule.
Recipe-IP protection is best-effort. Writ takes reasonable steps to keep an installed recipe's internal logic from being trivially exported, but cannot guarantee a recipe is fully opaque to someone who runs it on their own agent. Treat it as a best-effort protection, not a cryptographic one.
Honest about what each signal proves
We're deliberate about not over-claiming. Here's what each signal is, and what it is not.
Liveness status
Is: a read of whether recent real runs are succeeding, plus the time of the last success.
Is not: an independent re-test, a "verified working" certification, or compute spent to check on your behalf.
Performance metrics
Is: success rate and latency derived only from real cross-tenant runs (a creator's own tests excluded).
Is not: reliable until the listing has 20 real runs - until then it's shown as provisional / unverified.
Protections in practice
The safeguards that kick in after you've installed and run a listing.
On compliance. We operate with GDPR-aligned controls, a signed DPA, and encryption by default - a current security review is available on request. For our current security posture and processing terms, see the Trust center and the Data Processing Addendum.
Trust & safety FAQ
Can a creator see my login or my data?+
No. The creator's credentials and sessions are stripped at publish, and your run resolves only the data you attach - your own persona or login, your own vault secrets, and your own input values.
Is a listing independently re-tested before I install?+
No. Writ does not run independent re-tests. The liveness status shows whether recent real runs are succeeding and when the last successful run happened - it is observed from real activity, not a fresh verification on demand.
How do you keep reviews honest?+
A reviewer needs at least three backend-attested successful runs before they can post. Performance metrics are derived only from real cross-tenant runs and stay marked provisional until a listing has 20 of them.
What stops a creator from embedding a secret in a recipe?+
A publish guard. A literal embedded secret blocks publish until the creator parameterizes it into an input slot, so the value you supply on a run is always your own.
What happens if a creator changes the recipe after I install it?+
Your install stays frozen on the version you tested. You get an "update available" notice and choose when to sync - the change is never applied silently.
What if a run doesn't deliver?+
Report a problem on the run. Admins review every report and can pull a listing that has stopped working. The listing itself never costs you anything; a cloud run is metered by running time, because the cloud did the work.
Install with confidence
Your data stays yours, your install stays frozen, and every listing is free to install.