Security & privacy

The principles, concretely.

Workspace isolation

Every read and write, from the UI, the AI, the API, and running workflows, carries your workspace scope, enforced at the data layer. That includes execution time: a step's connection binding is resolved through the scope of the run, so a reference to another workspace's credential doesn't error interestingly. It simply doesn't resolve. API and MCP tokens are pinned to one workspace at mint and run under the minting user's permissions.

Encryption at rest

Sensitive fields are individually encrypted in the database, on top of disk-level encryption:

• connection secrets (OAuth grants, API keys), never rendered back into any UI after saving
• webhook bearer tokens and HMAC secrets
• chat history with Max, AI memory turns, and knowledge base content
• step pins and execution logs
• verified phone numbers, stored encrypted and matched by hash

Named secrets go one step further: {{ secrets.NAME }} is filled in only for the instant a step runs, and every resolved value is scrubbed from that step's output, error, and logs before anything is stored.

What the AI sees

Max works through the same scoped tools you use: it reads your workflows, runs, and data through your permissions, never other workspaces'. Connection secrets are excluded outright: the AI can bind a connection to a step, but no tool returns credential material.

AI requests run through MadMax's model provider account; your prompts and outputs are stored only in your workspace's encrypted history. Prefer your own provider relationship? Bring your own key, and AI steps bound to your connection call your account directly.

Approvals & webhooks

Approval email links are signed, single- purpose, and expire in 7 days. Inbound webhooks verify every delivery (bearer or HMAC) before anything runs, and an inactive workflow's URL is indistinguishable from one that never existed.

Found something? security@madmax.build reaches us directly.