Security & privacy
The isolation model: workspace scope on every operation, encryption at rest for sensitive fields, and exactly what the AI can see.
The principles, concretely.
Workspace isolation
Every read and write — from the UI, the AI, the API, and running workflows — carries your workspace scope, enforced at the data layer. That includes execution time: a step's connection binding is resolved through the scope of the run, so a reference to another workspace's credential doesn't error interestingly — it simply doesn't resolve. API and MCP tokens are pinned to one workspace at mint and run under the minting user's permissions.
Encryption at rest
Sensitive fields are individually encrypted in the database, on top of disk-level encryption:
- connection secrets (OAuth grants, API keys) — never rendered back into any UI after saving
- webhook bearer tokens and HMAC secrets
- chat history with Max, AI memory turns, and knowledge base content
- step pins and execution logs
What the AI sees
Max works through the same scoped tools you use — it reads your workflows, runs, and data through your permissions, never other workspaces'. Connection secrets are excluded outright: the AI can bind a connection to a step, but no tool returns credential material.
AI requests run through MadMax's model provider account; your prompts and outputs are stored only in your workspace's encrypted history. Prefer your own provider relationship? Bring your own key — AI steps bound to your connection call your account directly.
Approvals & webhooks
Approval email links are signed, single- purpose, and expire in 7 days. Inbound webhooks verify every delivery (bearer or HMAC) before anything runs, and an inactive workflow's URL is indistinguishable from one that never existed.
Found something? security@madmax.build reaches us directly.