Security

Overview

Maya is an AI visibility platform that analyses how your brand appears in AI-generated answers. This page summarises the security controls we apply to customer data — from credential handling to incident response — and is intentionally short enough to review in one sitting. For anything not covered here, reach out to [email protected].

Authentication

• User sign-in uses email + one-time code (NextAuth) or Google OAuth. Sessions are JWT-backed with a short rotation window.
• API / MCP access uses OAuth 2.1 with mandatory PKCE (S256), dynamic client registration (RFC 7591), and scoped access tokens (read:visibility, read:prompts, write:prompts). Access tokens expire after 60 minutes; refresh tokens rotate on every use and replay attempts revoke the entire chain.
• Legacy API keys (pre-OAuth) are hashed with SHA-256 before storage; only the first 14 characters are ever displayed. Users can revoke any token from Settings → MCP at any time.

Authorization & Scoping

• All access tokens are bound to a single user account. There is no cross-tenant token sharing.
• Every tool call re-verifies the caller's ownership of the target project (owner or explicit team membership) before returning data.
• Scopes are enforced per tool at request time; insufficient scope returns 401 missing_scope with a hint describing exactly what is missing.

Encryption

• In transit: all traffic is served over HTTPS/TLS 1.2+ via Vercel's edge. HSTS is enforced with a two-year max-age.
• At rest: databases are managed by Neon (Postgres) with disk-level encryption. Object storage (Vercel Blob / AWS S3) uses AES-256 server-side encryption.
• Secrets: third-party API credentials (OpenAI, Cloudflare, etc.) live in Vercel-scoped environment variables, not in the database.

Rate Limiting & Abuse Protection

• MCP tool calls are rate-limited at two layers: 300 requests/minute per token and 2 000 requests/minute per workspace (sliding window, Upstash Redis).
• Dynamic Client Registration is capped at 20 registrations per IP per hour to prevent registry flooding.
• Failed authentications, scope violations, and rate-limit hits are all recorded in the audit log.

Audit Logging

Every MCP tool invocation writes a row to mcp_tool_calls capturing the token id (hashed), user id, project id, tool name, status, latency, input hash, response size, error code, and schema version. Users can query their own activity; anomalies trigger operator alerts.

Data Retention & Deletion

• Operational data (prompts, runs, evaluations) is retained for the lifetime of the account so historical trend lines remain meaningful. Daily aggregates are partitioned by project; delete a project and all dependent rows cascade.
• Users can delete their account at any time. Deletion is propagated to Postgres within 24 hours; backups roll off within 30 days.
• We do not sell or share customer data with third parties. Third-party LLM providers see only the prompts you explicitly track, never user-identifying fields.

Hosting & Subprocessors

• Compute / edge: Vercel (US + EU regions)
• Database: Neon (Postgres, US-East primary)
• Cache / rate-limit state: Upstash (Redis)
• Email: AWS SES / Resend
• LLM providers: OpenAI, Anthropic, Google, Perplexity (only prompts/responses; no user metadata)
• Analytics: Google Tag Manager, Google Analytics (IP anonymisation enabled)

A current subprocessor list is available on request via [email protected].

Incident Response

• Material security incidents are investigated immediately and communicated to affected customers within 72 hours of confirmation, consistent with GDPR breach-notification expectations.
• A dedicated status page (rolling out Q2 2026) will host ongoing advisories.

Reporting Vulnerabilities

Found something? Please email [email protected] with:

1. A description of the issue and its impact.
2. Steps to reproduce, including any proof-of-concept.
3. Your contact information for follow-up.

We commit to acknowledging reports within two business days and will credit responsible disclosures in release notes when the fix ships.

Compliance Posture

Maya is not yet SOC 2 or ISO 27001 certified. We follow the relevant controls internally and plan formal audits as customer demand warrants. Data Processing Addenda (DPA) for GDPR-covered customers are available on request.

If your organisation has a specific due-diligence questionnaire, send it to [email protected] and we will return it within five business days.