Contact sales

Where your data goes, and who can reach it

An Australian-owned company serves Matilda from hardware it owns in Melbourne, and each commitment below links to where it’s written.

Ask for security documentation Privacy Policy
Where your data goes. Your prompt leaves your device encrypted in transit and lands in your workspace on MC-2 in Melbourne, encrypted at rest and isolated at the storage layer. When you delete a workspace, it’s purged within 30 days, including from cold storage. Three routes are closed. We don’t train shared models on your prompts or files, we don’t sell your data, and there’s no foreign parent a foreign government could compel.

Commitments

Every commitment, and where it’s written.

Rows sourced to the Privacy Policy are our published legal commitments, and rows sourced to product pages describe how the system is built. We list a certification here only once we can publish its report.

Where it runs

Infrastructure · Deployment options · Matilda Desktop

  • Matilda is trained and served on MC-2, the cluster we own and run in Melbourne.
  • An organisation’s own model runs in our Melbourne facility or its own data centre, connected or air-gapped.
  • Matilda Desktop reads your repo locally and keeps sessions, history and approvals in a folder on your disk.

Training

Privacy Policy · For organisations

  • We never use the contents of your prompts or files to train shared models.
  • We never sell your data.
  • An organisation’s own instance masks personal information on the way in and keeps it out of training, and no other customer’s model trains on its data.

Protection

Privacy Policy

  • Your data is encrypted in transit and at rest.
  • Each workspace’s data is isolated at the storage layer.
  • We log member access, and engineering access needs a paired review and leaves an audit trail.
  • We don’t look at your data unless you ask us to, or have to in order to keep the service running.

Your control

Privacy Policy · Deployment options

  • You can export, redact or delete any data your workspace has sent us.
  • We purge a deleted workspace within 30 days, including from cold storage.
  • An organisation holds its model’s weights and approves every new version before it goes live.

Jurisdiction

Sovereign AI · For organisations

  • Maincode is Australian-owned, with no foreign parent that a foreign government could compel.
  • The contract keeps an organisation’s chat history, usage, data and IP in its instance, in Australia.

On your own hardware

For organisations

  • Staff sign in through your identity provider.
  • Your instance keeps history, metering and an audit trail.
  • When it runs on your hardware, there’s no network route from us to your traffic.
  • At an air-gapped site, updates arrive as signed artefacts delivered offline, with a rollback.

Contact

Where to send security reports and privacy requests.

Security issues and privacy requests

security@maincode.com

Report a compromised key or account within 72 hours. Export, deletion and access requests reach a person within two business days.

Security reviews

Contact sales

We answer security questionnaires and send documentation to your assessors.