Security & trust
What Mumega stores, what stays yours, and how the pot keeps credentials and tenants isolated — the trust model in plain terms.
Mumega is built sovereign-first: your pot is yours. This page explains, in plain terms, what we store, what stays with you, and how the security model protects your data and credentials.
The shape of it
- Your pot runs on your infrastructure (or a workspace we manage for you on Cloudflare). Its data — members, agents, tasks, memory — lives in your pot’s own database, scoped to you.
- Authorization is yours. The role/capability system (RBAC) runs inside your pot, on any cloud. We don’t hold a central key to your authority.
- Authentication is delegated to your cloud’s perimeter (e.g. Google OAuth, Cloudflare Access) — a pluggable adapter, not a Mumega-controlled gate.
Credentials & secrets
- Encrypted at rest. Connector secrets (bot tokens, API keys) are encrypted in your pot’s vault. The raw value is shown once on provision/rotate, then never returned by any list or read.
- Resolved at call-time only. When an agent needs a credential, it’s decrypted for that one call and never logged, returned, or stored beyond it.
- Short-lived where possible. Integrations like GitHub mint per-use tokens that expire within the hour — nothing long-lived is kept.
- Revocable. Every key, token, and connector can be revoked instantly; revocations are recorded in an append-only audit trail.
Tenant isolation
Each tenant’s pot is a separate deployment with its own database and keys. One tenant cannot read or reach another’s data — the boundary is enforced at the infrastructure level, not just by convention.
What we don’t do
- We don’t train on your data.
- We don’t hold your content hostage — it’s in your pot, exportable, yours.
- We don’t require an Enterprise plan for the core product to be secure; security is the baseline, not an upsell.
How changes are reviewed
Every change to a sensitive surface — authentication, credential vaults, identity, external APIs — passes an adversarial review gate before it ships: an independent check that looks for ways the change could be abused, run in parallel with correctness review. Security findings are fixed before release, not after.
Your controls
- Roles & capabilities — scope exactly what each member and agent can do (Members & roles).
- Connector revocation — cut off any integration instantly.
- Approval-first actions — require sign-off before agents take consequential actions.
- Audit trail — see who (or which agent) did what, when.