security & data handling

What MAiPL reads, what it keeps,
and what it never does.

Written for the person on the other side of a security review. Everything below describes how the platform behaves today in pilot.

What MAiPL reads

Only the sources an account explicitly connects — a project tracker, a docs workspace, a code repository, a product-analytics workspace, or documents shared with it.
Access is read-only. MAiPL does not write back to a connected source, and it does not execute code from a repository.
Reading is event-driven, not scheduled scraping. MAiPL watches for genuine movement in a connected source and reads only when something actually changed.

Short extracted statements of fact, each kept with a link back to the exact place it came from, so any claim can be opened at its origin.
The relationships between those facts, the initiatives they support, and the decision history — which call was made, when, and on what evidence.
Usage counters for the pilot limits. Connection credentials are held in encrypted form and are never displayed back in readable text.
MAiPL does not keep full copies of source repositories, and does not build a hidden profile of individuals.

Each account's data is separated in the database and enforced at the row level: an account can read only its own rows.
Server-side code reaches data only on behalf of an authenticated account. The browser never holds another account's data.
There is no self-serve deletion button because there is no hidden store to reclaim: everything MAiPL holds is visible and cited inside the product, and disconnecting a source stops the reading. If you want an account's working data removed, ask and it is removed.

Extracted material is sent to a model provider for reasoning only, through a single server-side gateway. It is not used to train models.
No verdict is generated from the model's general knowledge alone. Every call is grounded in cited evidence you can open, and where an attribute has no evidence behind it, MAiPL says so and holds the call back rather than guessing.

Each pilot account has a ceiling on connected sources, on monthly reads, and on artifact updates, enforced on the server — reading stops when a ceiling is reached.
Access is granted per email address by an administrator. There is no open sign-up into the platform.
An administrator view shows, per person, connected sources, reads and artifact updates consumed, and the decision history can be exported for your own records.

Certifications, data-processing agreements and deployment arrangements are handled per engagement during the pilot conversation.