Security you can check for yourself.

Your team runs on your own computer, and each assistant's commands and file work run in a sandbox the operating system enforces, unless you choose otherwise. Every claim on this page is something you can check on your own machine.

See the boundary What stays on your machine

The operating system puts each assistant in a sandbox.

By default, each assistant's commands and file work run in a sandbox of its own, which denies everything and then grants only what that assistant needs. The background process that runs your assistants stays outside it. Where your computer offers it, you can instead put your whole team in one shared sandbox, with that process inside it. An assistant you give your whole computer, or one that runs on your Claude subscription, works outside the sandbox.

  • Writes are confinedBy default, each assistant writes only in its own workspace and any helper folders its sandbox names. When your whole team shares one sandbox, it also writes inside the install directory. Either way, it cannot rewrite the configuration, or its sandbox profile where its sandbox is built from one.
  • Reads are allowlistedWhat the sandbox lets an assistant read is a short list: the system folders and programs the software needs, and the folders Maxiful gives it. Your home directory is not one of them, so your documents and your own keys, such as SSH keys, sit outside the boundary. One exception: where your computer offers the shared sandbox, a ~/.mcporter folder that lists MCP servers is open to every sandbox, to read and change, with any keys those servers keep there. The sign-ins and keys Maxiful keeps for your connected accounts live in Maxiful's own folders: when your whole team shares one sandbox, every assistant in it can read and change them.
  • Levels do not change the sandboxThe four levels below change what an agent may do. They do not change whether it is sandboxed, which follows the access you choose and is the same at every level, Works on its own included.
  • You can check what it allowsWhere your computer's sandbox is built from a profile, each assistant has a profile of its own, a plain text file on your own disk, in the sandbox-profiles folder inside the folder that holds your team's data. When your whole team shares one sandbox, one profile covers it, in a folder under your install's name. Where your computer gives each assistant a container instead, no profile file is written: beyond its own workspace, the only folders of yours an assistant can open, unless you give it your whole computer, are the ones you add in Settings, which lists them. Either way, hold this page to what you find.

What holds, beyond the sandbox.

Three protections that are not the operating system's, each one tested rather than asserted.

  • Your screen and your camera stay yoursTwo plugins the agent runtime ships are switched off on every install, deliberately. One is whole-desktop control of your computer. The other reaches your camera and your location. A test holds both off in either direction. Everything else the runtime ships stays available, so these are two deliberate exclusions rather than a curated list.
  • What an agent reads is marked as dataText your agent reads from a file or a web page is wrapped in a marker before the model sees it, so instructions hidden inside a document are presented as content rather than as orders. The marker carries a random value generated for that one result, so a page cannot forge it by spelling it out.
  • A permission you change reaches the machineSaving a permission changes what your computer enforces, not only what the screen shows, and Maxiful tells you when the change is in force rather than assuming it went through.

Four levels, and what each one actually means.

You set a level per agent. The words mean exactly this and nothing more.

  • Works on its ownThe default on a new install. It runs on its own, and a payment, a deploy or an outgoing email still waits for your yes.
  • Asks when unsureCommands it knows run. A new command goes to a reviewer model first, and reaches you only when the reviewer will not clear it. The reviewer is a model and not a person, which is why we do not call its check an approval.
  • Asks firstCommands it knows run. Every new command waits for you. If nothing is connected that can ask you, the command is dropped instead of run, so this level fails closed.
  • Reads onlyIt can read, browse and report, and it cannot run commands or write files. What it may do with a tool you have connected is set by the switches below, not by this level.

You set each assistant's level on the Team page. When a change cannot take effect until the assistant restarts, Maxiful says so rather than showing it as in force.

The answers you give at setup follow every agent.

Ten switches in the setup wizard become tool denials on every agent on the machine, including the ones your Chief of Staff hires later. They are applied before the model is called, so an agent cannot talk its way past them.

Four things are always on and are not switches: AI reasoning, messaging you, reaching Maxiful's own services, and the agent's workspace.

Where your data goes.

Five answers, in the order a risk report asks for them.

  • What runs on your computerThe agent runtime, the tools it calls, its memory and any code it writes all run on your computer, under the sandbox rules described above. Your files, your conversations and your team's memory stay on your machine. Nothing of your agents runs on our servers. Nothing on our side can open a connection to your computer. Every connection is opened from your machine outward, to us. If you pair a phone or connect a chat platform that delivers by webhook, messages reach your agents back down that connection.
  • What a prompt carriesWhen an agent uses a cloud model, each call sends one prompt. It carries your message, the relevant conversation history, the agent's instructions and the material the agent is working with at that moment, which can include an excerpt of the file or email being worked on. That includes what the tools and APIs it calls return, when those results are in the conversation. The prompt goes through our model proxy to the provider, by default under no-training terms, unless the workspace owner allows providers that may train, which Maxiful holds off once a Google account has been connected. We do not store its content. For up to 7 days we keep the model name, the serving provider, the token counts, the cost and the time of each call, your plan tier, and technical fingerprints of the call, including a short digest of each earlier message, so we can tell whether the call could reuse the provider's cache. A digest cannot be turned back into the message.
  • A model on your own machineYou can run a model on the computer itself and choose it for any agent in Settings. Prompts to that model stay on the machine. It is reached over the computer's own loopback address and needs no key. Anything else the agent sends out, such as a web search, is listed on the transparency page.
  • Where code the agent writes runsAn agent writes code with the model it is set to use, so the writing prompt goes wherever that model runs. The code itself runs on your computer, in that agent's sandbox unless you have chosen otherwise, at the level you set for that agent. It never runs on our servers.
  • Encrypted in transit, and at rest where it sitsWhat travels between your computer and us goes over an encrypted connection. What we hold sits on Cloudflare's platform, which encrypts it at rest. What stays on your computer sits on your own disk, under your own disk encryption, in files written with restricted permissions.

Memory search runs on your machine wherever it can. On a machine with too little memory or disk for the index, and on a shared machine where the index cannot run, it goes through the model provider instead, and the app says so.

The path a prompt takes, and the three services on our side.

Everything that stays, and everything that leaves

Installers, updates and marketplace items.

Three ways code reaches your machine, and what each one verifies.

  • Signed installers with a published checksumEvery installer we publish today is signed by a certificate issued to PolyTrader Ltd, the company that published Maxiful before Maxiful AB. The download feed publishes the SHA-256 of the exact file we built, and whether that build came out signed, so you can check the bytes you received before you run them.
  • Updates verified against a key inside the appMaxiful's own updates are signed, and the verification key ships in the app rather than arriving with the update. An update that does not verify is refused rather than applied.
  • Marketplace items are signature-checked, and the scan is best effortA package whose signature or contents do not match what we published is refused. The automated content scan is a separate step, and if your machine cannot reach the scanner it reports that it could not check rather than reporting a pass.

Where your logins live.

The logins for the tools you connect stay on the machine you installed on, except the sign-ins of apps you connect under More work apps, which our connections provider holds for Maxiful in the United States. They are never passed on a command line, and no Maxiful code reads them back out. An assistant that works outside the sandbox, or one in the shared sandbox described above, can read them.

  • Each tool's login lives where that tool looks for itYour Maxiful session and the logins for the tools you connect stay on the machine you installed on, except the sign-ins of apps you connect under More work apps, which our connections provider holds for Maxiful in the United States. Some tools keep their own login in their own file, because that is where that tool reads it from. What matters is which machine they are on, and that is yours.
  • We have no code path that reads themNothing in the product sends your tool logins or your keys to us. That is a statement about the code, which you can hold us to, rather than a promise about our intentions.

No standing access, and a real uninstall.

  • No standing remote accessThere is no screen sharing, no remote session and no back door in the product, because none was built. Support sees a diagnostic bundle only when you assemble one and send it, and you can read it before you do. The remote support session our privacy policy and terms describe happens only if you agree to it for that one session, and you can end it at any time.
  • Use Remove from this computerIt removes the background process, the scheduled updater, the logon entries, the install's secrets directory and the device key it saved on your computer. It reports component by component what went. It leaves your other software alone, a shared Node runtime for instance, and tells you what it left rather than changing your machine's setup behind you. Removing only the app leaves the background process running with everything it holds, so use the uninstaller.
  • Diagnostics are opt-out and carry no contentA handful of setup events tell us whether installing worked. They identify the install by a random number, carry nothing about you or your work, and you can switch them off.

What we can show you today.

Signed installers with a published checksum. An update path that verifies against a key inside the app. A boundary you can check on your own computer: where your computer's sandbox is built from a profile, that profile is a plain text file you can read; where each assistant gets a container instead, Settings lists every folder of yours it can open, or that you gave it your whole computer. A transparency page that itemises every exit. All of it is on your machine or in public, which means you can check it rather than take our word.

Questions a careful buyer asks.

Do you train AI models on my work?

No. The prompt for each AI call travels through the Maxiful model proxy to the model provider, by default under no-training terms, unless the workspace owner allows providers that may train, which Maxiful holds off once a Google account has been connected. An assistant on one of your own subscriptions (ChatGPT or Codex, Grok, or Claude) sends its prompts to that provider under your own account and its terms instead, and with a model on your computer the prompt stays there. For up to 7 days we keep the model name, the serving provider, the token counts, the cost and the time of each call, your plan tier, and technical fingerprints of the call, and never the content.

Can an agent act without me?

You set a level per agent, and that decides it. On Asks first, commands it knows run and every new command waits for your yes; if nothing can reach you it is dropped rather than run. On Works on its own, the default on a new install, it runs on its own, and a payment, a deploy or an outgoing email still waits for your yes. On Asks when unsure a new command goes to a reviewer model first and reaches you only when the reviewer will not clear it; the reviewer is a model and not a person, and we do not call its check an approval for that reason. On Reads only it cannot run commands or write files at all.

Can you see anything on my machine?

Not on our own. There is no screen sharing, no remote session and no back door in the product, because none was built. Support sees a diagnostic bundle only when you assemble one and send it, and you can read it first. If you want hands-on help, a remote support session happens only with your consent for that one session, and you can end it at any time.

How do I check any of this rather than trust it?

Check the boundary. Where your computer's sandbox is built from a profile, the profile is a plain text file on your own disk that you can read rule by rule. Where your computer gives each assistant a container instead, an assistant works in its own workspace and cannot read or change Maxiful's settings or another assistant's work, and Settings lists every other folder of yours it can open, unless you gave it your whole computer. Compare the SHA-256 the download feed publishes against the installer you received. The transparency page itemises every exit rather than summarising them away.

What if I want it all gone?

Use Remove from this computer in Settings. It stops the background process, removes the scheduled updater and the logon entries, deletes the install's secrets directory, removes the device key it saved on your computer, and reports what it removed. Removing only the app leaves the rest running, so use the uninstaller.

Does anything of my agents run on your servers?

No. The agent runtime, its tools, its memory and any code it writes run on your computer, under the sandbox rules on this page. Our servers do three narrow things. The model proxy meters each AI call. The account service holds your subscription and serves updates. A relay carries messages for a paired phone or a chat platform that delivers by webhook. None of them runs an agent.

Do you store any of the content?

No. The prompt for a cloud call passes through our proxy and is not stored by us. For up to 7 days we keep the model name, the serving provider, the token counts, the cost and the time of each call, your plan tier, and technical fingerprints of the call, including a short digest of each earlier message, so we can tell whether the call could reuse the provider's cache and so your dashboard works. A digest cannot be turned back into the message. One exception is worth naming. When your computer is offline, the relay holds messages for a paired phone for up to 7 days, in an encrypted envelope it cannot read.

Where does code the agent writes run?

On your computer, in that agent's sandbox unless you have chosen otherwise, at the level you set for that agent. The agent writes it with the model it is set to use, so the writing prompt goes where that model runs: through our proxy for a cloud model, nowhere for a model on your own machine.

Can I keep everything on my machine?

If the computer runs a model of its own, you can choose it per agent in Settings, for the agents that handle sensitive work. Prompts to that model stay on the machine. Your account and subscription still live with us, and setup diagnostics still reach us unless you switch them off.

Found a problem?

Write to [email protected]. A report about our software reaches a person rather than a queue. If it is urgent, say so in the subject line.

Email [email protected]

Read the rest before you decide.

The architecture in full, and the itemised list of what stays on your computer and what leaves it.

How a local-first install works What stays, what we store