Business owners
Let your agents buy supplies, software and travel inside rules you signed, with a record your accountant can check.
Early access · free until 31 Dec 2026
Your rules for every agent that pays for you.
AI agents can now buy things on your behalf. Zillq Charta decides how far they go: write your spending rules in your own words, confirm them with your account, and every payment an agent asks for is checked against them before any money moves, with proof of every decision.
- Test payments only in early access
- Hosted in the EU
- No card needed
- 01 Write your rules
- 02 Confirm it is you
- 03 Agents ask
- 04 Charta decides, and proves it
The missing layer of your digital identity
Identity says who you are. Charta says how far anyone may go in your name.
Your digital identity already proves who you are, and that it's really you. It says nothing about what software may do with your money. Charta adds that layer: rules that belong to you, not to an app, signed by you, and checked by everyone who has to honour them.
- 04What you allow CHARTAYour confirmed spending rules, each agent's limits, and proof they were kept.
- 03What's true about youAttestations: your age, address, IBAN, licences.
- 02That it's you, nowYour password, passkeys, security keys, your identity wallet.
- 01Who you areYour national eID, the EU Digital Identity Wallet, your bank.
How it works
From your words to a signed rule, and every payment checked against it.
-
01
Say it in your words
Describe what your agents may spend. Charta turns it into precise rules.
-
02
Read it back, try it
Charta reads the rules back in plain sentences and runs them on example purchases before you sign.
-
03
Confirm it is you
Nothing is in force until you confirm it: the exact rules, not a summary. Charta can't confirm for you. Your password is enough; add a security key and only the key can.
-
04
Connect your agents
Each agent gets its own key and a mandate you sign. It can ask to pay; it can never raise its own limits.
-
05
Keep the proof
Every decision, refusals included, is recorded with the rule that decided, in a chain anyone can check.
See your rules decide
An agent asks. Your rules answer.
Pick something for the agent to buy. Today it has already spent €20.00.
Your rules
- Refuseif the category is “alcohol”.
- Refuseif today's spending plus this payment is more than €80.00.
- Ask mewith my confirmation if a payment is more than €30.00.
- Allowotherwise, without asking me.
The agent asks to buy…
Charta's answer appears here.
A simulation in your browser, with these four rules. In Charta, your signed rules run in a sandboxed rule engine on every request, and every answer is recorded.
Why Charta
Every app has limits. Only yours go with you.
Banks, cards and agent platforms each let you set limits, in their own settings, for their own product. Charta keeps one set of rules that is yours, and every agent you connect has to pass it.
| Question | Limits inside each app or card | Zillq Charta |
|---|---|---|
| Who sets them | The provider, in its own settings | You, confirmed by you |
| Where they apply | In that one app, card or account | For every agent you connect, whichever way it pays |
| Who can change them | Whoever is signed in to your account | Only you: your password again, or your security key if you added one. Making them stricter takes a tap |
| Refusals | Seldom recorded | Always recorded, with the rule that decided |
| Proof for a bank, an auditor or a court | Ask the provider | Export a file that carries its own signatures |
| How you write them | A form with fixed fields | Your own words, read back to you before you sign |
When an agent needs you
Approve from your phone, with the key in your hand.
When a payment needs you, Charta can email you. Open the link on your phone, read exactly what you'd be approving, and confirm with your password, or touch your security key if you added one. If nobody answers, the payment expires and is refused. It is never approved by default.
- What you confirm is shown in words generated from the request itself.
- Your key can be plugged into the computer, held to the phone over NFC, or plugged into the phone.
- Declining takes one tap, and the agent is told why.
Security
Built so a mistake stays small.
Agents misread, get tricked, or just get things wrong. Charta assumes they will, and limits what any single mistake can cost.
Decided before money moves
Charta answers before the payment is made, not afterwards. A refused payment never starts.
Your choice of strength
A password is enough to start, and the record says so. Add a security key, which can't be copied, and only the key can change your rules or agents: a stolen password then touches nothing.
Agents can't raise their limits
An agent's mandate is a ceiling it can't lift. Widening it needs your confirmation, or your key if you added one; your rules can only make it stricter.
Nothing waits forever
A payment that waits for you expires and is refused if nobody answers. It is never approved by default.
Every refusal is evidence
Refusals are recorded like payments, so “the agent never tried” and “the record was lost” can't be confused.
Charta never holds your money
It decides and records. Your bank or card provider moves the money, and Charta keeps no card numbers.
Who it's for
For anyone who lets software spend in their name.
People with AI assistants
An assistant that books and buys for you, without a blank cheque, and that asks you when it should.
Families, and protection from scams
Rules like “nothing over €500 to someone new without my daughter's key too” guard against pressure and fraud, not only agents.
Banks, payment providers, agent platforms
Honour your customers' Charta before you pay, and keep evidence a supervisor can verify. Write to hello@zillq.com.
Trust levels
A Charta that can prove more can do more.
Each level ties your Charta more firmly to you. Early access covers the first two, with test payments. Real payments are planned from level 3, with small limits to start.
- LEVEL 1
Account
An email and a password. Write your rules in your own words, confirm them with your password, connect agents and have them paid.
Available - LEVEL 2
Your key
Optional, and stronger: with a security key, only the key can approve changes, and what it signs anyone can verify.
Available - LEVEL 3
Your identity
Tie your Charta to your national eID or the EU Digital Identity Wallet.
Planned - LEVEL 4
Your bank
Your bank confirms the account is yours, and can rely on your Charta for every payment.
Planned
Pricing
Free while it's early access.
Early access
€0until 31 Dec 2026
- Your own Charta, kept apart from everyone else's
- Rules drafted from your words, read back and tried
- Your own agents, and a practice agent to start with
- Approvals by email, confirmed by you
- Export of everything, with its signatures
For institutions
Let's talk
- A decision before every agent-initiated payment
- Signed evidence, kept for as long as you must keep it
- Designed for SEPA transfers, card issuing and the EU Digital Identity Wallet
- A readiness review against PSD3 and the Payment Services Regulation
There is no billing in early access, and no card is asked for. Prices will be published on this page before anything is charged.
Questions
Questions, answered plainly.
What is Zillq Charta?
A place for your spending rules: what AI agents may pay for in your name. You write the rules in your own words, confirm them with your account, and every payment an agent asks for is checked against them before any money moves. Each decision is recorded, refusals included.
Is Charta a bank or a wallet?
No. Charta never holds money. It decides whether a payment is within your rules and records that decision. Your bank or card provider moves the money.
Does real money move today?
Not yet. In early access every payment is a test payment: a simulated bank transfer, or a simulated single-use card. You can try everything without risk.
Is an email and a password enough?
Yes. That is all it takes to start, and it is the default. You create an account with an email and a password, write your rules, connect agents and have them paid. When something needs you, you enter your password again and it counts for five minutes.
What that is worth, said plainly: Zillq Charta keeps two things apart. Your account proves who you are. The consent platform decides what your agents may do and keeps the evidence. How strong your account is, is your choice: the platform records which proof stood behind each approval, and your rules can ask for more. With only a password, anyone who has your password can do what you can, and the record says "account confirmation", not "signed by a key".
Is there something quicker than my password for confirming?
Yes: a PIN, six digits you choose in the app. Once you set one, it confirms what you approve instead of your password, so a stolen password can sign in but can't approve anything. Setting it shows a twelve-word recovery phrase, once, to write down. Forget the PIN and the phrase brings it back; lose both and a reset completes after 72 hours, with your PIN working meanwhile and a notice to the addresses you proved.
If you forget your password, choose Forgot your password? on the sign-in page and we email you a link.
Do I need a security key?
No. A security key is optional, and stronger: any FIDO2 security key, such as YubiKey or TOKEN2. Once you add one, only the key can approve changes to your rules and agents, so even a stolen password could not touch them, and what it signs is a signature anyone can verify. You can add it any time, from Security in the app.
The same key also signs you in with one touch. A passkey on your phone or computer can sign you in too, and so can your national eID card.
Can I use my phone instead of a security key?
If you added a security key: for small things, yes. For anything that gives an agent more room, the security key is needed. Without one, your password confirms everything.
- Your phone can make your rules stricter, remove an agent and approve smaller payments, with its fingerprint, face or PIN.
- Your security key is needed to connect an agent, give it a mandate, loosen your rules and approve larger payments.
Why the difference? Most phone passkeys are kept in your Apple, Google or password-manager account, and copied to every device that account reaches. That's convenient for signing in to websites. But it means such a passkey can't show which device signed, or that you were the one holding it. A security key never lets its secret out, so what it signs, you signed.
Your phone still helps: plug your security key into it, or hold the key against it, and approve from wherever you are.
Which AI agents work with Charta?
Any agent that can use an MCP server, such as Claude Code. Charta gives it three tools: what it may buy, asking to buy, and checking on a request. The agent makes its own key; Charta only sees the public half. There is also a practice agent built in.
What happens when an agent asks for more than my rules allow?
It is refused, with the rule that refused it, or it waits for you if one of your rules says to ask you. You can get an email; nothing is paid until you approve, and a request nobody answers expires.
How does Charta know it's me?
By several proofs at once, each a different kind: something you hold (your security key, an authenticator app, your phone number), something you are (a passkey with your fingerprint or face), something you know (your password) and places you can be reached (your email addresses). Later, official proof: your national eID or EU Digital Identity Wallet, and your bank.
An email and a password are enough to start, and they are the default. Each proof has its own strength, from 1 to 5: a security key is the strongest, a password the weakest. Your journal records which proof was used for every sign-in, signature and payment. Your agents can say how strongly you're proven, but never your name, addresses or keys. What each proof is worth.
Can I take my rules and records elsewhere?
Yes. Export everything as one file: your signed rules, your agents and every decision, with the signatures that prove them.
Where is my data?
On a server in the EU (Amazon Web Services, Milan). Each person's Charta is a separate database. When you ask Charta to draft rules from your words, those words are sent to Amazon Bedrock in the EU; nothing about your payments or keys is. More about your data.
What if I lose my security key?
This is about a security key you added; a password alone involves no key. Once you add one, nobody can loosen your rules or connect an agent without it, and that includes us, so add a backup key and keep it somewhere safe. In early access there is no self-service recovery if every key is lost; write to hello@zillq.com.
Who makes Zillq Charta?
ZILLQ, an independent payments lab and the team behind the zillq.com payments sandbox.
Write your first rules today.
Free during early access. Test payments only.