How the platform is designed
- Credentials never leave the backend. Connection secrets are encrypted at rest (AES-256) and decrypted only inside the API to run a request. Agents, apps, browsers and model providers see results, never credentials.
- Read-only by default for agents. Every MCP grant and default API key is read-only, enforced lexically (single
SELECT/WITH) and, where the database supports it, inside a read-only transaction. Writes require scopes a workspace admin creates deliberately and, for SQL, a connection explicitly marked as allowing agent writes. - Isolation. Apps build and preview in per-user sandboxes; notebook kernels run in managed containers; published apps are static, content-addressed bundles.
- Least-privilege authentication. OAuth 2.1 with PKCE for agents, rotating refresh tokens, hashed API keys, per-workspace scoping on every route. MCP credentials are rejected on every other endpoint.
- Hosting. Google Cloud Platform, europe-west1 (Belgium, EU); encrypted in transit (TLS 1.2+) and at rest. Backups are encrypted and access-logged.
- Supply chain. Open-source code, dependency updates by Dependabot, releases to npm and PyPI through OIDC trusted publishing — no long-lived publish tokens exist.
Responsible disclosure
If you find a vulnerability, email security@mako.aiwith a description, the affected component, reproduction steps and your view of the impact. Please do not test against other customers’ data or degrade the service.
- Acknowledgement within 2 business days.
- Fix or mitigation plan within 10 business days for confirmed high-severity issues.
- Credit in release notes if you want it. We do not pursue legal action against good-faith research that follows this page.
Machine-readable version: /.well-known/security.txt. Repository policy: SECURITY.md.
Data residency and sub-processors
See the Privacy Policy for the current list of sub-processors and locations. Enterprise customers can request a data-processing agreement at legal@mako.ai.