Security

• Each Mainframe has its own Google Cloud virtual machine, service account, storage bucket, database, and backup schedule. The machine is the trust boundary.
• We do not pool Customer Content across customers.
• Published machine tiers make the underlying infrastructure visible instead of hiding it behind an abstract usage limit.

• Launch regions are europe-west1 in Belgium and us-central1 in Iowa.
• Your billing country sets a suggested region, but you can override it.
• Connected services and selected AI providers may process data outside your machine region. Those flows are explained in the Privacy Policy.

• Google Cloud default encryption protects virtual-machine disks, snapshots, buckets, and databases at rest.
• Web and API surfaces use TLS in transit.
• Administrative access runs over a private Tailscale network. Tenant machines do not expose public SSH.

• OAuth tokens and API keys live in a per-customer secret namespace. Connector code resolves a reference only when it runs.
• API keys are collected through single-use secure forms that expire after 15 minutes, never through chat.
• AI subscription logins use the provider login flow on your machine. Browser-session passwords are entered directly into your machine through a live takeover window.
• Secret values are excluded from workspace files, chat history, control-plane responses, and logs, with automated checks and redaction.

• The default posture is read-only or draft-only. Sending, posting, or writing is a separate permission upgrade.
• OAuth credentials for remote connectors are injected by the authentication gateway, so models do not receive raw tokens.
• Remote tool lists are pinned at installation. A changed tool set pauses for re-approval instead of silently gaining capability.
• Installed connector code is visible in your workspace and can be inspected, edited, or removed.

• Approval authority is bound to your identity, not to an agent credential.
• The permission floor is enforced by the runtime. An agent cannot prompt its way around a capability it has not been given.
• Memory, concurrency, and worker budgets limit resource consumption by tier.

• Claude and ChatGPT subscriptions run under your direct provider relationship from your dedicated machine.
• Bring-your-own API keys bill directly to your chosen provider.
• Bundled credits route through OpenRouter using a separate, hard-capped key for your account.
• Mainframe does not use Customer Content to train models. Provider handling remains governed by the selected provider's terms.

Before publication, Inflection Systems will document the exact OpenRouter routing and data-policy configuration used for bundled credits.

• Agent-made file changes are committed with provenance, so they can be inspected and reversed.
• Restores, browser takeover sessions, and secret access create audit events.
• Supervisor logs record operational metadata such as event type and byte counts, not prompt text, goal text, or secret values.
• Technical users can inspect their own machine directly.

• Backups live in the selected region and are encrypted at rest.
• A safety snapshot is created before a restore.
• Restore operations create a durable audit record.

• Payment failure starts a 7-day grace period, followed by 30 days suspended and 90 days archived before deletion.
• The archived state retains a final snapshot, database export, and workspace bundle while deleting the running machine and disk.
• You can export the workspace repository, files, and database at any time.

• The formal incident-response process and any public response-time commitments are still being finalized.
• No specific response-time guarantee will be published before the process exists operationally.

• Google Cloud provides machines, storage, databases, backups, and secret management.
• Stripe handles payments and tax. Mainframe does not store card details.
• OpenRouter supports bundled AI credits. Telegram carries messages when you choose that surface. Tailscale provides private networking. ElevenLabs supports voice replies when enabled.
• A final live subprocessor register, including locations and provider links, is required before publication.

• Inflection Systems is responsible for the isolation model, platform software, secret store, permission floor, backups, and providers it selects.
• You are responsible for approvals, connected-account scopes, third-party terms, changes made through direct machine access, and the security of your own login and Telegram account.

• Mainframe does not currently hold SOC 2 or ISO 27001 certification and will not imply otherwise.
• AI output can be wrong, incomplete, or manipulated by content it reads. Review anything you approve.
• Connected apps, model providers, and communication channels have security properties outside our control.
• This page describes the current architecture and will evolve with the service.