How we protect your data

We believe trust is earned through transparency. Here is where Maindex stands today and where we are headed.

What we do today

Tenant isolation

Every account is a fully isolated tenant. Your data is never shared, mixed, or accessible by other users. Database-level row isolation enforced on every query.

Encryption

All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Locked collections add an additional layer of passphrase-based access control.

Authentication

OAuth-first authentication through WorkOS. No passwords stored by Maindex. API keys available as a fallback for headless environments, with per-key revocation.

Access control

Locked collections are hidden from all sessions until explicitly unlocked. Step-up re-authentication is required for destructive operations like account deletion and locked data export.

Teams and shared collections

Team memory is reachable only through explicit per-collection grants. Roles run owner, manager, editor, viewer, enforced at route handlers, service checks, and Postgres row-level security. Team tenants cannot authenticate directly.

Automated content review

Writes to team collections are screened on our servers with automated checks and agentic review. We look for prompt injection, secrets and API keys, injected instructions, and profanity. Clean content publishes immediately. Flagged content stays invisible until a manager approves, rejects, or redacts it.

Audit logs

Every team action is recorded in an append-only log: membership, role changes, collection changes, review verdicts, and more. Managers can query it by actor, action, and date. Nothing in the product can edit or delete an entry.

Personal and team separation

Team managers cannot see members' personal memories. Personal memories are reachable only through a query path that team contexts never take, enforced by row-level security. Copying personal content into a team creates a new memory with a new ID.

Group Billing

One invoice for a whole team, or everyone on their own plan. Same prices either way. Who pays changes; what it costs doesn't.

Teams safety at a glance

Fair question. Shared memory that anything can write to is a liability unless something is checking.

The concern	What actually happens	Where it's enforced
Something bad got in and screening missed it	A manager can forget the memory and purge its revision history. It's gone, not flagged.	Deletion + purge semantics
Prompt injection in shared memory	Team writes are screened for injected instructions, secrets and API keys, and profanity before the team can see them. Clean content publishes immediately; flagged content waits for a manager.	Server-side review pipeline
API key pasted into team knowledge	Secrets check flags it. Managers can redact: shadow copy preserved, restorable.	Review pipeline + shadow fields
Can my manager read my personal memories?	No. Team queries can't reach personal memories; lookup returns "not found."	Postgres row-level security
Accidental leak of personal notes into team	Copy personal to team creates a new memory; audit logs destination only. Optional setting blocks agent copy-in.	Copy service and audit design
Someone quits: what happens to access?	Remove them; grants cancelled immediately. Their contributions stay with the team.	Membership state machine
Junior deletes half the graph	Viewers are read-only. Editors write; only owners delete teams (deferred grace period). Soft deletes + revision history.	Role checks + RLS
Who changed what?	Append-only audit log: 20+ event types, queryable by actor, action, date.	Team audit log
Owner's card fails	Team freezes; data untouched. Manager on a create-tier plan can claim the team.	Billing gates
Training on our data?	No. Not memories, metadata, tags, links, or graph.	Company policy
SOC 2 certified?	Not yet: targeted for early 2027. Today: tenant isolation, RLS, AES-256 at rest, TLS 1.2+, OAuth-first auth.	This page
Leaving Maindex	Export any team collection to JSON. Standard MCP: nothing proprietary.	Data export
My company pays for my account: what happens if I leave?	Your personal graph stays attached to your email. Team contributions stay with the team. Resubscribe on your own plan and your memories are there.	Tenant ownership
Can we pay for the whole team on one invoice?	Yes. One person creates a billing group and covers everyone; seats can be added and removed as the team changes.	Group Billing

What we are building

SOC 2 Type II | Target: early 2027.
SSO / SAML | Enterprise single sign-on for team accounts.
Data residency options | Choose where your data is stored.
Locked team collections | Passphrase protection on shared collections.