Security & Product Principles
Built For The Data You'd Never Hand Over Lightly.
MAEVE handles the most personal data in your professional life — the people in it. Here is exactly how we treat it, and the principles we've committed to as a product team.
The Security Model
Six Non-Negotiables.
Encrypted End To End
TLS 1.3 in transit. AES-256 at rest. Keys rotated on a defined cadence, scoped per account.
Isolated Per Account
Your relationship graph is a private tenancy. No cross-account queries. No shared model state.
Never Trains External Models
Your data is never used to train models that touch anyone else's account — including ours.
Opt-In Ingestion Only
Nothing is ingested without your explicit consent. Disconnect any source at any time.
Portable & Deletable
Export everything as a portable file. Delete everything and we forget you exist within 24 hours.
Human-Reviewed Access
Any privileged access to production is logged, time-bound and reviewed by a second engineer.
Our Product Principles
Restraint Is A Feature.
Assistive, Never Autonomous
MAEVE never sends on your behalf without an explicit, in-context confirmation. It drafts. You decide.
Explainable By Default
Every recommendation carries the signals that produced it. You can inspect the reasoning, and correct it.
Restraint Over Reach
We do not build features that push you to contact more people, more often. That is not the product.
Download
MAEVE Security Overview (PDF)
Version 1.0 · 5 KB · 3 pages · For diligence, vendor review or internal circulation.
Responsible Disclosure
Report A Security Issue.
We welcome researchers acting in good faith. If you've found something that could affect the safety of our members' data, please tell us before disclosing publicly. We commit to responding quickly, engaging in good faith, and giving you credit where you want it.
Where To Send It
Email security@maevehq.com with a reproduction path and impact. PGP key available on request.
What To Expect
A human reply within one business day. Triage and remediation status within five. Public credit at your discretion.
Our Commitments
No legal action against good-faith research. No demands to sign an NDA before triage. No silent patches — you'll hear how the fix landed.
*-preview.lovable.app). For the full data-handling policy, including retention and subprocessors, see the privacy page.