TRUST / SECURITY
A private cloud computer* for your workspace, clear connection permissions and practical safeguards for your work.
Effective 24 October 2026Your Mainframe runs on a private cloud computer.* Each customer has an isolated workspace. Members of the same customer account share that workspace under its account arrangements. Cloud physical infrastructure and Mainframe’s control plane, authentication, billing and gateways may serve multiple tenants. Selected model providers and connected services process information outside the workspace runtime when needed for your tasks.
Your order identifies the available deployment region. Your Mainframe runs in that region. This is not a promise that every provider or platform record stays there: identity, billing, support, model requests and connected services may involve other locations. See the Privacy Policy for international transfers.
We use encrypted web connections and cloud encryption for managed storage. Encryption at rest does not prevent an authorised process from reading data while using it. Our operational access is restricted to authorised personnel and maintenance channels; it is not customer-facing access.
Use the connection forms and provider login flows to authorise accounts. Supported integrations resolve stored credentials when an operation needs them. Secret references and redaction are safeguards, not a guarantee that credentials are inaccessible to agents with host access. Provider CLIs, browser sessions, environment variables and files may have different credential handling. Do not store secrets in workspace documents or paste them into prompts. Revoke or rotate a credential promptly if you suspect exposure.
Connections use the scopes you grant. Revoking a connection prevents future use through that connection; copies already made require separate deletion. Connection grants govern operations through those connections. Account-specific settings may separately control sending and writing. Agents can also use installed software, the filesystem and network available to their host runtime. System-integrity restrictions protect selected infrastructure operations; they do not make the runtime a connection-only sandbox.
Only give an agent access appropriate for its task. Do not assume every external action will present a confirmation screen: confirmation requirements vary by operation, connector and your settings. Imported documents, websites and messages can contain misleading instructions. Review important work and use the narrowest practical account access.
Mainframe does not use your content to train AI models. You can use your own AI subscription, your own API key, or managed credits. AI requests send relevant context to the services used to produce the answer.
If you connect your own ChatGPT account, its training settings remain under your control. Your own OpenAI or OpenRouter API accounts also remain governed by your settings and agreement. No-training does not mean zero retention; provider security, abuse monitoring and legal retention are separate.
The board records agent activity, and supported operations produce audit events. Workspace history can help inspect and recover tracked changes. This is not a complete audit: these mechanisms do not record every possible host operation or preserve every file automatically. Do not treat them as a complete forensic record or as a substitute for your own business continuity arrangements.
Keep independent copies of critical work. File and folder downloads let you retain usable copies outside Mainframe. Workspace history only covers tracked content; it is not a complete account backup or an assurance of recovery.
Mainframe uses cloud infrastructure, payment processing and selected AI services. Messaging, voice and other integrations add providers when enabled. A tenant deployment region does not control all those providers’ processing locations. A connected account may be your direct supplier relationship rather than a Mainframe subprocessor.
Use the privacy contact form to request the applicable provider information or a data-processing agreement before a supplier review or sensitive deployment. A data-processing agreement identifies the providers and processing arrangements covered by that agreement.
Report suspected vulnerabilities or exposure through the security contact form. Describe the affected feature and how to reproduce the issue without including passwords, tokens or unnecessary personal data. Do not access another customer’s information or disrupt the service while investigating.
The form provides a submission reference. Keep it when following up on a report. Do not include credentials or unnecessary customer data. Any notification obligation depends on the incident, the parties’ roles and applicable law; no fixed response-time guarantee is offered here.
We are responsible for operating the platform and its security controls. You are responsible for your users, account access, content, authorised integrations and the changes you make to your environment. Direct system modifications can affect security, backups and supportability.
No system is perfectly secure. Mainframe does not currently hold SOC 2 or ISO 27001 certification. AI output can be inaccurate or manipulated. Third-party availability, retention and account decisions are outside our sole control. We update this page when material practices change.
* Solo plans run on a shared, isolated cloud computer. All other plans get their own dedicated machine.