Plainly, how your data is handled.

Security overview

Last updated 5 November 2026. Draft pending legal review. Nothing here is a certification or a guarantee. We tested these controls ourselves and fixed the problems we found.

How the pieces fit

Your browser (or the Chrome extension, or an app using the developer API) talks to the gateway, a Cloudflare Worker. The gateway checks your sign-in, applies your plan and limits, builds the prompt and sends it to the model server, a rented GPU server behind a small proxy that checks a secret key. Chats, files, artifacts, memory and settings live in a Cloudflare database; generated pictures in a private storage bucket; small flags and locks in a key-value store. Servers are started when needed and deleted when idle. The web app, admin console and this website are static files with strict content-security policies. See Sub-processors.

Sign-in and authentication

• You sign in with Mayfair ID (OpenID Connect, authorisation code with PKCE). Artemii never sees your password.
• The gateway verifies each access token's signature, type, issuer, audience and expiry. In testing, tokens with algorithm "none", a rogue key with the same key id, the wrong audience, issuer or type, expired tokens and tokens missing required fields were all rejected, and a forged "admin" claim was ignored.
• Administrator rights come from a fixed list set by the operator, not from a claim a user can edit.
• Tokens are kept in browser session storage (web app) or extension session memory, never in persistent storage or addresses, and are not logged. That makes them sensitive to script injection on the page, which the app's strict content-security policy is there to prevent.
• Developer API service keys are shown once, stored only as hashes, and can be scoped, rate-limited, bound to origins, set to expire and revoked. They are refused in browsers.

Isolation between people

• Every database query that touches personal content carries the signed-in person's id. In testing, a second account trying to open the first account's chat, artifact, preview, file, memory, project, assistant, share, picture, connection or approval received "not found".
• All queries use bound parameters.
• Company knowledge is shared with the organisation by design; everything else is scoped to the person.
• Artifact previews run in a sandboxed frame with no access to your account or other tabs and no network connections. Share links use long random tokens, can be revoked, and are blocked for incognito chats.

Encryption and secrets

• Traffic to the gateway, to Mayfair ID and to providers uses HTTPS.
• Tokens for connected services are encrypted at rest with AES-256-GCM, bound to your account and that connection, so a copied record cannot be opened elsewhere. They are never returned by any route, never logged, and removed from error text, tool results and the activity log. Key rotation is supported.
• Other stored content (chats, files, memory) is held in Cloudflare's database and storage and relies on Cloudflare's encryption at rest.

Actions need your say-so

• Tools that change something (send, post, create, delete, change settings, make a picture) ask first by default.
• Prompt-injection rule: once the AI has read outside content in a chat (a web page, an attachment, a result from a connected service), every action that changes something asks again, whatever your setting. Untrusted content is labelled as data and the AI is told not to follow instructions inside it. This reduces, but cannot remove, the risk that a malicious page steers the AI. It is a safeguard backed by the approval step, not a guarantee.
• The server stores the complete arguments of an action waiting for approval and checks them when you approve. The apps are being updated to show every argument of long or nested actions, so until then such an action may show a shortened summary or be refused.
• Time limits, call limits and repeat guards stop runaway tool use in one answer.

Permissions and control

• Per connector, Mayfair app, tool, web access, file search, memory and API client: off, read, ask or allow. The most specific setting wins.
• Administrators can set a maximum level for any of these and can forbid a connector or an app outright.
• One click disconnects every service (asking each to revoke the token), cancels pending approvals and switches every permission off.
• An activity log shows what Artemii did with tools, apps, connections, memory and API use (kept 90 days, secrets removed). Administrators see metadata and counts, not content.

Web access and request forgery protection

The AI can open web addresses only if web tools are on. The gateway permits public https addresses only: no credentials in the address, no non-standard ports, no local or internal names, no disguised numeric addresses, and private, loopback, link-local (including cloud metadata) and reserved ranges are blocked for IPv4 and IPv6. Names are resolved and the answers checked; redirects are followed by hand and re-checked; a cross-host redirect drops the authorisation header. Page size is capped. Known residual risk: the address check and the fetch are two steps, so a name that changes its answer between them (DNS rebinding) is not fully excluded.

Connectors and Mayfair apps

• Remote-server (MCP) connections support OAuth 2.1 with PKCE, a single-use state that expires in 10 minutes, and a browser-bound cookie so a link started in one browser cannot be completed in another.
• A custom server's own claim that a tool is "read-only" is not trusted. Only built-in connectors an administrator has marked trusted run read-only tools without asking.
• At most 20 connections per person; tool lists and results are size-limited.
• Mayfair app tools receive your access token only at exact hosts an administrator has registered, with no redirects, and verify both your token and Artemii's signature.
• Sign-in flows with third-party services have so far been tested only against simulators.

Abuse and availability

Per-person and per-address rate limits (the per-address limit uses the salted hash described above), a cap on answers running at once, an automatic temporary pause for repeated violations (reading, export and deletion keep working), request size caps, storage accounting with row caps, and a price ceiling on GPU rental with a single server at a time. Kill switches exist for Direct mode, the developer API, image generation, assistants and individual tools. Availability is not guaranteed; the first answer after idle time can take minutes while a GPU starts.

Audit and logging

• The administrator audit log records who changed which setting, with redacted details, append-only, for 400 days.
• Gateway logs contain events and short error messages. They do not contain message text, prompts, picture prompts, tokens or request bodies. The GPU proxy logs only the request path.

Testing and review

• An internal security review of the gateway, apps, extension and website was done on 5 November 2026 by a read-only review with proof-of-concept tests. It found no critical issues, two high issues (legacy tools bypassing the permission and request-forgery controls, and a denial-of-service weakness in HTML parsing) and eight medium issues. All high and medium issues and most low issues were fixed in code, with regression tests. A small number of low-severity items remain open, in the Chrome extension and in how the browser session holds the token, and one is partly fixed (some counters are kept after "delete all my data").
• The review did not cover production configuration, every admin and app screen, or the website pages in depth.
• Automated test suites cover the gateway, app, admin console, extension and website.

Incident handling

Mayfair keeps an internal incident response procedure: severity levels, a named lead, containment steps (switches and key rotation) and notification. For a personal data breach affecting you where we are the controller, we notify the Information Commissioner's Office within 72 hours of becoming aware where required, and tell affected people without undue delay when there is a high risk to them.

Your part

Keep your Mayfair ID secure. Review connectors and apps and give each only the permission it needs. Allow the Chrome extension only on sites you are comfortable with. Check important answers: AI can be wrong.

What we do not claim

• No ISO 27001, SOC 2, Cyber Essentials or similar certification.
• No independent penetration test to date.
• No uptime or recovery-time commitment.
• No claim that prompt injection is solved; protection is layered (labelling, approvals, permissions, limits) and imperfect.
• No claim that the model is correct, unbiased or safe in every case.
• No claim about the security of connected services, Mayfair apps' own systems, or your device and browser.

See also Data retention and deletion, Sub-processors and AI transparency.