Data Processing Note
Last updated 2026-10-19
For business customers: how MagnateAI processes the personal data in your workspaces, including your model keys and the data of apps you connect. A signed data processing agreement is available on request: [CONTACT EMAIL].
Roles
You are the controller of the personal data in your workspaces (for example customer details your agents handle). We process it as your processor, only to provide the service and on your instructions, which include the agent permissions and approvals you configure.
Model keys (BYOK)
- Keys you add are encrypted with AES-256-GCM under a key derived for that purpose only, and are never returned by the API, shown in the app, or included in exports.
- They are decrypted only in the server process that makes a model call for your workspace.
- Calls made with your key are billed by your provider to you; calls made with our keys are capped per workspace per day.
Connected apps
- App sign-in runs through Composio, which holds the access tokens; we store a connection id, never your app password.
- Agents can use only the actions you allow. Actions set to "Ask CEO" run only after you approve the card that shows their exact arguments; "Disabled" actions never run.
- Fire drills and Industry CI use sandbox copies of apps, never your live accounts.
- Disconnecting an app, or the purge of a deleted workspace, revokes the connection at Composio.
Security measures
- Encryption in transit (TLS) and at rest; per-workspace isolation enforced in the database (row-level security), with automated tests.
- Role-based access (owner, admin, operator, viewer); an audit log of admin changes and approvals.
- Outbound calls to agent endpoints you register are restricted to public HTTPS addresses.
- Rate limits and spend caps; an agent kill switch that halts all work at once.
Subprocessors
We use the subprocessors below and will notify you before adding or replacing one.
| Subprocessor | Purpose | Data |
|---|---|---|
| Supabase | Database, sign-in and file storage | All account and workspace data |
| Vercel | Web application hosting | Requests in transit; request logs |
| Inngest | Background jobs (agent runs, schedules) | Job events with record ids; step results |
| Anthropic, OpenAI, OpenRouter | AI model calls (with our keys or yours) | Prompts and model outputs for the work you assign |
| Composio | Sign-in to and actions on connected apps | App access tokens; action inputs and results |
| Resend | Sign-in codes and notification email | Email address; message content |
| Apple Push Notification service | iOS notifications | Device token; notification text |
| Sentry | Error and crash reports | Error details with your user id (no email or request bodies) |
Incidents, deletion and audits
We will notify you without undue delay, and within [NOTIFICATION WINDOW, e.g. 72 hours], after becoming aware of a personal data breach affecting your workspace. At the end of the service, or when you delete a workspace, its data is permanently deleted after the 7-day restore window and removed from backups as they roll off. Data may be processed in [REGIONS, e.g. the United States]; transfers rely on [TRANSFER MECHANISM].