What Cockpit is and the safety model

What Cockpit is

Cockpit is a chat-first console. You describe an outcome in plain words. The Copilot decides which of your connected systems to read, reads them with a fixed set of tools, and answers with what it found. When a change is needed, it proposes the change as an approval card and waits for you.

You can connect five systems: Salesforce (one or more orgs), MuleSoft (Anypoint Platform), GitHub, Slack and Postman. Your Google sign-in is listed alongside them on the Connectors page. Cockpit runs in a web browser, and as an app for Mac and Windows. Phone apps are coming.

Sandbox and Production

Cockpit has two modes. They describe what Cockpit may do, not what kind of org you connected. A free Developer Edition org can be used in Production mode; a real production org can be used in Sandbox.

There are three ways to be more careful than the account mode:

• Per connector. In Production mode you can turn writes off for one connector at a time (for example, Slack read-only while Salesforce can write). The switches are in the panel under the chip and on the Modes page.
• Per chat. A single chat can be made Sandbox from its menu in the Chats panel. That chat stays Sandbox for good: it cannot be switched back, and you start a new chat to write again.
• By attaching an org. Attaching a Salesforce org to a chat with the plus button (arriving) makes that chat Sandbox for the same reason.

The strictest setting always wins. The account mode, the chat's mode and what is switched on in the Cockpit deployment are combined, and the result is enforced on the server before any tool is offered to the Copilot. The chip is a view of that setting; it is not what protects you.

Approval cards

Every write waits for an approval card. The card is built from the exact call that will run, not from a summary the AI wrote about it.

{
  "sobject": "Account",
  "fields": { "Name": "Example Ltd" }
}

• Summary. One plain sentence, for example "Create a Account in Salesforce with Name".
• Exactly what will run. The complete input, in a box you can scroll. If a change is too large to show in full, it is split into several cards instead of being cut short.
• A SHA-256 fingerprint of that input. The approval is bound to it: if the input changed, the approval would not apply.
• Where it lands. The card names the Salesforce org (name and address), the Slack workspace, or the GitHub repository and base branch. The approval is bound to that target too. Before the write runs, Cockpit reads the target again. If you moved the chat to another org, reconnected the org to a different address, or the repository's default branch changed, the write is not sent and the answer says why.
• Tool name and blast radius. The name of the tool, and a short statement of how far the change reaches.
• Approve or Deny. Denying writes nothing.

• A card expires after 10 minutes. A late decision is refused and the card shows expired.
• If you tighten the mode after a card appears, approving it is refused and nothing is changed.
• "Always allow" exists only for plans and reads. It is never offered for a write, so every write needs its own approval.
• Your approvals are listed on the Approvals page and under the Approvals tab of the Brain panel.

What the Copilot can and cannot do

Which of these write actions your account actually has depends on what is switched on in the Cockpit deployment you use. They are being switched on in stages: GitHub pull requests first, then Salesforce records, then Slack posts. The Connectors page tells you for each connector: the tag reads "Read + write" when writes are possible and "Read only (no write actions yet)" when the connector has none switched on.

What is stored

• Deleting a chat removes it from your list at once and for good after 30 days.
• Disconnect stops Cockpit using a connection. Its chats are kept, but they cannot read that system again until you reconnect it. What else Disconnect removes depends on the connector, and the confirmation sentence says which: on GitHub and Slack it keeps the app details you saved so you can reconnect in one click; on a MuleSoft connection it removes the saved client id and secret; on Postman it deletes the stored key, and the key still works in Postman until you revoke it there.
• Delete, on a connector card, removes the connection and your saved app key and secret as well.
• Delete account on the Account page removes your account and everything in it straight away: threads, approvals, connections, usage, devices and AI consent. Cockpit asks each connected tool to revoke its access where the tool allows it. MuleSoft and Postman keys cannot be revoked by Cockpit; it deletes its copy, and you revoke them in Anypoint and Postman. Encrypted backups expire on their normal cycle.

Where your data goes: one AI provider

Cockpit uses one AI provider, Anthropic (Claude). To answer you, Cockpit sends your messages, and the results of the tools the Copilot uses for you, to Anthropic. It does that to produce replies. Before your first chat the console asks you to agree to this, and you can withdraw your agreement at any time on the Account page; chat stops until you agree again. The provider list has a version: if it ever changes, you are asked again.

Your connected systems are contacted by Cockpit's servers, using the credentials in the vault, when the Copilot calls a tool. The AI provider does not log in to your systems; it receives only what Cockpit sends it.

The privacy policy, in its current published form, is at cockpitai.io/privacy. Where this manual and the policy differ, the policy governs.