How your data
is protected

Not a shared table with a customer column — a separate PostgreSQL database per customer, created when the account is and dropped when it is deleted.

With a shared table, one query missing one filter exposes everyone. With separate databases the connection does not have the other data in scope at all, so the mistake has nothing to expose.

MegaClaw writes code from your description and runs it. The question that matters is what that code can touch. It runs in an isolated container:

no access to the local network     only the internet, only outbound
256 MB memory, half a CPU          capped
no Linux capabilities              dropped entirely
no privilege escalation

A firewall blocks it from every private network range. The platform verifies both the container network and the firewall rules on every start, because a rule lost in a reboot would otherwise be silent.

When you connect a service, the credentials are encrypted at rest with AES. The key is on the server and never leaves it.

The generated code does not contain them. It refers to a value that is supplied when the code runs and is never written anywhere — so the stored code for a task is safe to read, and contains nothing worth stealing.

• Two-factor authentication from any standard authenticator app, available to every user, with eight single-use backup codes.
• Attempt limiting — five failures, then a fifteen-minute wait, counted per account and per address.
• Changing your password ends your other sessions. A password changed because it leaked is worthless if the old session keeps working for another day.
• Your administrator can reset a user's two-factor if they lose their phone, so a lost device is not a lost account.

Deleted automatically after that. Storing the payload of an incoming call is off unless you turn it on for a specific workflow, because that payload is whatever the calling system sent.

Deleting your account drops the database and removes the rest.

TLS 1.3. HTTP redirects to HTTPS. Standard security headers on every response.

The approval page — where someone clicks Approve or Decline — cannot be loaded in a frame at all, which is the attack that page would otherwise invite.

Found a problem? We will confirm receipt within two working days.