Download
Download

MonarchSecurity

Trust you can verify

How Monarch decides what it may do, where the hard boundaries are, and what lies beyond them.

Three possible decisions

Allow

The action fits the chosen mode — Monarch executes it and verifies the result.

Ask you

A one-time confirmation bound to that exact action. If the action changes, a new one is needed.

Deny

A hard stop. Neither confirmation nor owner rights can lift it.

Access modes

How much freedom Oscar gets — is up to you.

Three autonomy modes, as in Monarch’s settings. Hard limits don’t depend on the mode.

What happens to the action

  • Read a fileAllow
  • Change a file in the projectAllow
  • Launch a programAsk you
  • Delete a fileAsk you
  • Payment or money transferDeny
  • Change protected areas of WindowsDeny

An “ask” permission is one-time and tied to one exact action. If the action changes, a new one is needed.

What no “yes” can unlock

  • Deleting a drive root or an entire workspace
  • Changing protected areas of Windows
  • Escaping the allowed folder through links and workarounds
  • Access to the Safe, passwords, tokens and keys
  • Disabling Monarch’s or Windows’ protections

Monarch Safe

A vault even Oscar can’t enter.

Encrypted storage for files and private chats. A separate process with no network, its own PIN and its own keys.

AES-256-GCM
Every file version gets its own random 256-bit key.
PIN + device
The PIN is bound to a secret on this computer: a copy of the vault on another PC can’t check it.
3 keys
Three recovery keys in case you forget the PIN. Three wrong PINs destroy the keys.
No network
The Safe window is isolated: no network, no launching programs, clipboard closed by default.

The agent never gets access to the Safe. Not with full access, not with owner rights.

An honest boundary: the Safe can’t protect you from malware already running under your account while it’s unlocked.

Monarch Security

A sentinel that stays when the window closes.

Security runs apart from the app: close Monarch and the watch goes on. It’s built on strict rule-based checks; a model only advises.

  • Scans never delete files or kill processes on their own
  • Online file reputation checks are off by default
  • The log keeps codes and hashes, not the contents of your files

Security is an early version (Beta), not an antivirus. It complements Windows Defender rather than replacing it.

Security

Still running

Events

  • Attempt to change a scheduled task
  • Network connection: known process
  • New file in Downloads checked
  • Startup items: no changes

How Security responds to Oscar’s actions

Stops an action when its risk score is 70% or higher.

70%
  • 12%Read the project foldercarried out
  • 58%Change startup programscarried out
  • 84%Run a downloaded filestopped

Scores are illustrative

Honest updates

The stable channel is signed with an Ed25519 key. Monarch checks the signature, size and SHA-256 of the installer before installing, puts the new version next to the old one and rolls back if it fails to start.

  1. 01ManifestThe version list is signed with an Ed25519 key
  2. 02CheckSignature, size and SHA-256 — before installing
  3. 03Side by sideThe new version installs next to the old one
  4. 04RollbackIf it doesn’t start, the previous one comes back

What lies beyond protection

  • Malware already running under your account
  • An administrator or a Windows kernel-level compromise
  • A modified and rebuilt copy of Monarch
  • Physical recovery of data from an SSD after deletion