Your agents. Your brand. Your keys.
Build agent tools that use real keys without showing them to the model, with the deny.sh toolkit. Keep your brand and customer relationship. Local code libraries are free under Apache 2.0; commercial application-layer rights and support use the partnership terms below.
Built for products running AI agents
Keep real credentials in trusted software; give agents decoys or references. Both passwords are required together; a separate control file selects the message. Protection depends on keeping real control material separate and on the evidence available outside the encrypted file.
Agent platforms
Give agents decoys; trusted tools use real keys.
Agent tool providers
Check requests. Return approved results, not credentials.
Agent frameworks
Encrypt inside trusted tools. Restrict access to real control files and passwords.
Secrets managers
Resolve real keys inside trusted software. Retain existing access controls.
Security platforms
Send decoy alerts from deny.sh into your incident workflow.
Internal AI tools
Connect agents to company services without putting real keys in chat.
How a partnership works
Three integration models. Pick the one that fits your stack.
SDK embed (most common)
Use a software development kit (SDK), a code library embedded in your app. Core operations include: encrypt, decrypt, generateDecoyControl. Password-to-key libraries include hash-wasm in TypeScript, argon2-cffi in Python, the argon2 crate in Rust, golang.org/x/crypto in Go) for portable Argon2id. Available for Node/TypeScript, Python, Rust, Go. Ships in your binary, runs on your infrastructure, never phones home.
Hosted API (white-label)
Your customers hit your domain; we proxy the cryptographic work. You keep the brand and the relationship. The hosted service receives inputs for processing. Agree capacity, support and a service level agreement (SLA) in the contract.
Co-branded surface
"Deniable backup, powered by deny.sh." A small attribution badge in exchange for a deeper revenue share. We help your customers trust the cryptography because we're the people who built it.
Commercials
Choose the structure that matches your product. Scope and reporting terms are agreed in writing.
Revenue share
Best for products where deniability is a paid premium tier. We take 15 to 25% of incremental revenue attributable to the deny.sh-powered feature. Recognition rules and reporting cadence agreed in writing.
Per-seat licensing
Best for products with a defined paid user-base. From $2/seat/month at the entry tier, scaling down with volume. The SDK is Apache 2.0 (free, no licence required). The seat-licence covers application-layer embedding rights, dedicated support, security updates, and a commercial licence on the application-layer code where needed.
Annual flat fee
Best for hardware wallets, on-device implementations, or products where per-seat tracking is awkward. Starts at $50,000/year for unlimited deployment within a single product line.
What's always included
Architecture review with our team. Multi-language SDK. Priority engineering support. Quarterly security updates. Co-marketing if you want it. NDA on whatever you need it on. Commercial application-layer embedding rights for the term of the partnership (the SDK is Apache 2.0 and free for embedding regardless).
Why partner instead of building it yourself
The cryptography is the hard part
Deniable encryption schemes are easy to design badly. Subtle errors break deniability without breaking the obvious tests. We're the people who shipped the open-source reference implementation. The browser verification suite at /verify is publicly auditable.
Independent audit on the roadmap
Third-party cryptographic audit on the roadmap, results published when complete. Do not represent the planned audit as completed assurance for your product.
Story you can tell
Explain what your integration does: one encrypted file, a chosen alternative message and clearly separated control files. State the limitations alongside the feature.
Plan your integration
Start with one workflow. Integration effort depends on key custody, access controls and your product’s risks; agree a scoped evaluation before planning rollout.
Talk to partnerships
Tell us what you're building and how your customers are protected today. We will scope the integration and commercial terms with you.
Looking for individual API access? See standard pricing. Building an internal tool? See enterprise plans.