Skip to content
navoka
ConnectStart a chat

Private by design.

An AI agent with money is safe when the account is its own, the card is a token, and the limits are yours.

Start a chatDeveloper docs

Its own account and card.

Navoka's agent has a dedicated stablecoin wallet, an IBAN and a card. They belong to the agent and to nothing else: a separate ledger, separate rules, a card issued in the agent's name. Money moves between the agent's account and your other accounts instantly, so it has what it needs when it needs it — and what it does with it is bounded by the rules you set, not by how much it can see.

A specialist, not a generalist.

Navoka is a payments-and-finance agent, not a general-purpose assistant with a card bolted on. Everything it does is a payment, a transfer, a payout or a record of one. That narrowness is a security property: the tool set is small, every tool writes a ledger row, and there is no path from "summarize this document" to "send money" because the agent doesn't do the former. Your general assistant can ask it; it can't become it.

The card is a token.

The agent holds a normal debit card, provisioned as a network token, never as a card number. The PAN exists in the card issuer's vault and nowhere else — not in the model's context, not in its logs, not in the chat. Because Navoka issued the card, every authorization is checked against your mandate before it's approved: merchant allowlist, per-transaction ceiling, daily velocity, category, country. Subscriptions and card-on-file ride on the same card.

What the agent sees

  • card_token: tok_9f2…
  • agent card ••4412
  • rules: allowlist, $600 ceiling, $800/day
  • never a PAN, expiry date or CVV

What the network sees

  • A tokenized card authorization, approved only if it passes the mandate
  • the PAN, from the vault, at authorization only

A leaked token still runs into your rules — allowlist, ceiling, velocity — and you can freeze it in one tap.Limits and approvals

One agent, one machine.

Each agent runs in its own isolated virtual machine with its own encrypted storage. Nothing is pooled: no shared memory, no shared files, no shared context between one holder's agent and another's. The agent's conversation, ledger and rules live in that one machine, and the machine is torn down and rebuilt on revoke.

  • One agent, one VM.

    Your agent's process never shares a machine with another holder's.

  • Per-agent storage.

    Ledger, rules and conversation are stored per agent, encrypted at rest.

  • Approvals never carry secrets.

    What you see in the chat is the payee, the amount and the reason. IBANs and card numbers stay in the account.

What the agent can never do.

  • See a card number.

    It holds a token; the PAN is in the issuer's vault.

  • Change a limit.

    The mandate is holder-only; there is no agent tool that writes it.

  • Approve its own payment.

    Approve and Decline are bound to your identity — your account and device, or your web session — never to an agent or assistant session.

  • Do anything that isn't a payment.

    It has no tools outside payments, transfers, payouts and the ledger.

  • Act after you stop it.

    The kill switch freezes the cards and pauses the rules at the account, not in the agent. A stopped agent can ask; nothing is executed.

Built to be trusted with money.

  • The card only pays inside your rules.

    Merchant, amount, velocity, country — checked at every authorization, not afterwards.

  • It cannot change its own limits.

    Limits are set by you, outside the agent's reach.

  • Disconnect in one tap.

    Card frozen, rules paused, assistants unlinked.

Powered by Wirex.About Navoka

Report a problem.

Found a security issue? Write to security@navoka.com. We acknowledge within 2 business days, and we don't take action against good-faith research. If money moved that shouldn't have, "stop everything" in the chat first, then write.

Questions.

Is it safe to give an AI agent access to my money?
It is when the agent has an account and card of its own, holds a card token rather than a card number, runs on its own isolated machine, and works inside limits it cannot change. Navoka is built that way, and it only does payments and finance — so there is no tool that isn't a payment, and no payment without a rule.
What does "dedicated to the agent" mean?
The stablecoin wallet, the IBAN and the card belong to the agent: its own ledger, its own rules, a card issued in its name. You move money between it and your other accounts instantly, in either direction. What the agent can do with that money is set by the mandate — budget, threshold, allowlist, velocity — not by how much is there.
Can the card number leak through the chat or the assistant?
No. The agent is provisioned a network token; the card number stays in the issuer's vault and never enters the model's context, its logs or any conversation. A captured token still has to pass your mandate at authorization — allowlist, ceiling, velocity — and you can freeze the card in one tap.
What is "one agent, one machine"?
Each agent runs in its own isolated virtual machine with its own encrypted storage. No shared memory, files or context with any other holder's agent. Ledger, rules and conversation live there, and the machine is torn down on revoke. It's the same isolation you'd expect between two customers' servers.
Who approves a payment — me or the model?
You. Approve and Decline are bound to your account and device, or your web session. An agent or assistant session cannot press them. Inside your rules the agent pays without asking, because you already approved the rule; outside them, nothing moves until a person taps.

Give your agent something to pay with.

Its own account and card. A token, not a number. Limits you set once.

Start a chatConnect your assistant