Security and data

In short

• Maurice runs where you decide: on a computer, on your server, or on a dedicated machine we host.
• An AI model is called only at the steps that need one, with the provider you choose.
• Your secrets stay in a vault: a tool receives a limited capability, never the secret itself.
• Every tool has its permissions; unplanned access is refused; a sensitive action waits for human approval.
• We collect nothing without your consent.

Where Maurice and your data run

What goes through an AI model

• When: when a tool is designed, at judgement steps, and when Maurice works as an agent. Rule-based steps, run as code, send nothing to a model.
• To whom:
  • with your keys, directly to the provider you chose (Anthropic, OpenAI, Mistral, Google) or to a local model, without going through us;
  • with our credits, through our gateway, to the models we host. Our list of sub-processors is in the data processing agreement.
• No hidden switch: if a provider does not answer, Maurice retries with the same provider and then reports the failure; it does not send your data elsewhere.
• Before a pilot, we document with you what goes through a model, and where.

The vault: AI never holds your secrets

Our principle: the AI is not trusted; the envelope around it is. A model can be fooled by any page it reads. So we design every feature by asking: if the model were completely hostile, what could it do? The right answer looks like "spend at most €80 with this merchant in the next ten minutes", never "know the card number".

• A tool receives a capability, never a secret. One precise, bounded operation: a merchant, an amount, a duration, a number of uses.
• The vault performs, it never hands over. It can pay, sign, sign in; it never returns the card, the password or the key.
• The decision comes from a rule or a person, never from the model.
• You approve with your passkey (Touch ID, Face ID, hardware key), on the vault page, seeing exactly what you authorise. Your signature covers those exact conditions: what you see is what you sign, and what you sign is what runs.

Two compartments

If our servers were compromised, an attacker would get no sealed secret: only what your rules allow, through revocable capabilities.

One vault per person, which follows them from one Maurice instance to another. An organisation vault is shared with authorised members.

Recovery is chosen at creation, and shown: a personal recovery code, or a company escrow held by several administrators. Without the passkey, the code or the escrow, nobody can open the vault, neither you nor us.

Your AI keys and workflow secrets

• Your AI provider keys and tool tokens are encrypted at rest (AES-256-GCM).
• An Agent Spec never holds a secret in clear text: it references it, and the contract rejects a plain-text secret.
• Secrets are entered outside the conversation with the assistant.

Who can do what

• Identities: sign-in with a passkey or your company SSO (OIDC); SAML and automatic provisioning on the Enterprise plan.
• Roles: administrator, editor, viewer; plus business roles per team, defined by the company.
• Permissions per tool: every workflow states who may use it. Out-of-scope access is refused, with the reason.
• What your assistant can do: nothing you have not allowed. Every grant has a scope, a duration and a quota, and can be withdrawn at any time; a withdrawn grant blocks the following calls.
• Human approval: a sensitive step waits for the decision of a designated person, made in their own session, never by the assistant. Without a decision in time, the step does not happen.
• Pairing links: single use, valid for 15 minutes.

What is logged

• Every run: steps, tool calls, model calls, cost, human decisions.
• Authentication events: sign-ins, failures, key rotation, role changes.
• Logs mask known sensitive values (keys, tokens).

Code execution

• Workflow code runs in a sandbox (Deno) with explicit permissions: no network access outside the Agent's allowlist of hosts, limits on time, output and memory, a private directory per run.
• This sandbox isolates through permissions; it is not a virtual machine per run.

What we collect

• On the website: audience measurement (PostHog, hosted in the European Union), only after you accept it in the banner. No session recording.
• When installing Maurice: only if you accept it in the install text, a random identifier, the version, the operating system and the architecture. Without consent, nothing is sent.
• Never: the content of your tools, your data or your conversations.

How we build

• Every change goes through automated checks: secret scanning, static analysis, dependency vulnerabilities.
• Fix times we commit to internally: critical 24 h, high 7 days, medium 30 days, low 90 days.
• Our MCP servers are open source: their code is public, so you can read and audit it. github.com/agentmaurice/mcp

Certifications

Maurice does not have a certification yet (ISO 27001, SOC 2, HDS). We answer your security questionnaires and provide a data processing agreement.

Report a vulnerability

Write to contact@agentmaurice.ai, subject "Security vulnerability". Acknowledgement within 3 business days, assessment within 7 business days, coordinated disclosure. Our disclosure policy