Agents prepare. People file, sign and pay.
There is no endpoint that files with a registry, signs a contract or moves money. Not gated: absent.
How to tellThe API has no filing, signing or paying endpoint.
Mission
Take the work to the last step. Then stop.
Our mission is to give every company a team of agents that prepares everything, and to leave every decision that binds it with its people.
Our mission, in one breath
Our mission is plain.Give every company a team of agents that takes the back office to the last step.Make every step checkable by the people who rely on it.Charge one flat price per company, never per token.And leave every decision that binds the companywith a person who holds a passkey.
What we do, every day
Nine commitments
we work to.
Each one is a rule in the product or a promise we keep in public. Under each, how you can tell.
A passkey for every decision that binds.
A password can open the Console. Only a passkey can approve, with a gesture less than two minutes old.
How to tellNo API key or connected app can approve.
An agent never sets its own limits.
An agent cannot read or change what stops it. That is enforced where the data lives, not in a prompt.
How to tellAnything binding stops, whatever the amount.
Read-only, by type.
Every connector is read-only by type, and a write scope cannot be registered. Drafting an email is allowed; sending it is not.
How to tellNo stored logins, no robot browsers, no bank credentials.
Checked, by design.
Bernina, the guardian layer, is designed to check every Run before, during and after, and to stop a write, a leak or an injected instruction.
How to tellBernina never counts against your Runs.
Every step on the record.
Every step an agent takes, every tool it reads and every decision, with the reasoning, goes into an append-only log.
How to tellHash-chained, so it cannot be edited after the fact.
Your work, asked for.
People at Zuger ask before they look at your work. An owner or admin approves with a passkey, or says no.
How to tellFour hours at most. Every look is listed in your Seal Log.
One price per company.
Never per seat, never per token, never billed on demand. At the limit the agents wait and ask.
How to tellNothing is charged until you approve it.
Honest about what is ready.
What is built is called built. What is on the roadmap is called the roadmap, until it is ready.
How to tellWe would rather say not yet than round up.
Sort the month
Who does what?
Sort it.
Ten tasks from one ordinary month. Tap one and it goes to its side of the line.
Agents prepare
You decide
Tap a task. It goes to its side of the line.Reading and reconciling run freely. Nothing leaves.Filing with a tax authority is yours, by design and by law.Prepared to the last step, with the workings attached.There is no endpoint that signs. A person signs.A redline is a draft. It waits for you.Anything a customer will read stops for a person.Drafted in your voice. Drafting is allowed; sending is not.Zuger cannot move money. There is no endpoint that does.Built from the figures, ready for you to read.An agent cannot read or change what stops it.Everything binding is on your side of the line.
The decision
Checked before it reaches you.
Signed only by you.
How a Run ends: Bernina’s three checkpoints, then your passkey. Approving prepares it; nothing files itself.
VAT return · AugustSäntis · prepared · for you to file
Waiting on youApprovedBerninaAs designed
- BeforeRead for injected instructionsCheckingPass
- DuringEvery tool call against a read-only listCheckingPass
- AfterScanned for secrets and other companies’ dataCheckingPass
ApprovedApproving does not file it. The return waits for you to file.
- 01Säntis prepared itEvery figure with its source. Nothing guessed.
- 02Bernina checked itBefore, during and after, as designed.
- 03You decideA passkey on the device in your hand. No password.
- 04Nothing files itselfApproving prepares it. Filing stays yours.
An illustration. Bernina is built into the path every Run takes; the checks shown are how it is designed to work.
How we get there
Now, next,
and always.
No dates we cannot keep. Just the order we work in.
Now
Built
- Dom, Säntis and Eiger: orchestration, finance and pipeline.
- The Console, one approvals queue, and a passkey for every decision.
- Zuger in Claude and over MCP.
- Bank statements by CSV, and example data to try it on.
Next
One by one, as each is ready
- Xero, Stripe, Gmail, Notion, HubSpot and nine more, read-only by type, as each provider approves us.
- Live read-only bank feeds through a licensed open-banking provider.
- Pilatus, Titlis, Gotthard, Matterhorn and Zermatt, each labelled roadmap until it is ready.
- Telegram, WhatsApp and the iPhone app.
Always
The line stays where it is
- Filing, signing and paying stay with people.
- An agent never approves its own work.
- One flat price per company.
- The roadmap is labelled as the roadmap.
Never
What we will not do.
We will never
- Bill you by the token.
- Charge per seat.
- Train models on your work.
- Sell your data.
- Hold your bank logins.
- Drive a browser with your password.
- Let an agent approve its own work.
- Make the work quietly worse to stay inside a budget.
Free plan · No card
Bring your company.
Start free, no card. One flat price per company when you need more.