> ## Documentation Index > Fetch the complete documentation index at: https://www.macaly.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Security overview > What's built into Macaly, and where you and the platform meet Every Macaly project starts with secure foundations built in. Encryption, EU hosting, authentication, isolated databases, and edge protection come ready out of the box. This page explains what runs in the background so you don't have to set it up, and what stays with you as the person publishing the project. ## How security works on Macaly Security in any web application involves both the platform underneath it and the person building on top. Macaly takes care of the infrastructure layer: hosting, encryption, the authentication library, edge protection, isolated databases, and ongoing security updates. You stay in charge of the application layer: what data your project stores, who can access it, and how your end users are informed. This split means you don't need to set up servers, certificates, or auth libraries from scratch. It also means decisions about your data and your users stay with you, where they belong. When your project stores personal data about your end users, Macaly acts as a data processor and you remain the data controller. Full details are in our [DPA](https://www.macaly.com/dpa). ## What's built in ### Hosting and data residency Published projects are hosted on Vercel's EU region (Frankfurt). Databases run on Convex EU West (Ireland). Both sit behind Vercel's edge network, which serves content from servers closer to your visitors and mitigates attack traffic before it reaches your project. Each Macaly project gets its own isolated database, so data from one project is never mixed with another. You can also choose the region where the AI models the agent uses to build your projects run. If you need your data to stay in the EU, you can select models hosted only in the EU. For the list of available models and the countries where they are hosted, see [AI models](/docs/en/agent/models). ### Encryption Data is encrypted in transit and at rest: * HTTPS is enforced on every published project * Data at rest is encrypted at our hosting and database providers * Sensitive credentials used internally by Macaly are encrypted before storage ### Authentication Macaly's built-in authentication uses an industry-standard library that handles password hashing, session management, and one-time codes. Two methods are available: * **OTP login** for passwordless email-code authentication * **Email and password login** with signup, verification, and reset flows You don't need to set up a separate auth service. Describe what you need in your prompt and the agent connects it to your project's database. ### Secure-by-default agent The Macaly agent is guided by built-in practices that apply across every project. Authentication, database access patterns, secrets handling, and integration setup follow established defaults rather than being assembled from scratch each time. The agent works in a secure sandbox with real development tools, so it can build, run, and test your project in an isolated environment. You can also ask the agent at any time to walk you through how a specific part of your project is protected, or to adjust something based on your needs. See [Building secure apps](/docs/en/security/building-secure-apps) for practical guidance. ### AI transparency Macaly tells people when AI is involved. A notice above the prompt explains that you are working with an AI agent, and published projects carry a machine-readable `ai-generated` tag in their head, plus a **Made with AI in Macaly** badge by default. These cover the platform. Disclosures about your own project, such as a chatbot you build for your end users, stay with you. See [Using AI responsibly](/docs/en/security/using-ai-responsibly) for where the line sits. ### Edge protection and updates Vercel's edge network and platform protections handle common abuse patterns automatically, including DDoS mitigation and basic bot filtering. Security-relevant fixes to our infrastructure and underlying dependencies roll out across all projects continuously, so you don't need to track or apply patches yourself. ### Vulnerability scanning and security reviews Macaly scans published Next.js apps for known framework vulnerabilities. If a critical issue is found, publishing stays blocked until you resolve it by clicking **Fix Now**, which sends the fix straight to the agent. You can also run a full [security check](/docs/en/features/security) on your project at any time. The **Security** tab in your chat reads through your code, reports what it finds in plain language across eight areas from access permissions to payments, and can apply the fixes for you. The first check in each chat is free. ## What's in your hands When you publish a project on Macaly, the application itself is yours. A few things naturally stay with you, since they depend on your project and your users. ### Data and compliance You decide what data your project collects and stores. Compliance with GDPR, the CCPA, and other laws applicable to your end users is something to plan for as part of building. In practice, this usually means: * Letting your users know how their data is handled * Adding a privacy policy if your project collects personal data * Including a cookie banner if your project serves EU visitors * Being able to handle user requests for access, correction, and deletion The agent can help with most of these. Adding a privacy policy, a cookie banner, or a data deletion flow is a normal part of working on a project. ### Your application's access controls The agent can build authentication, role-based access, and ensure each user only sees their own data. How these are set up for your project, and who sees what, is part of describing what you want. The next page, [Building secure apps](/docs/en/security/building-secure-apps), covers how to do this well. ### Backups Macaly provides several safeguards for your project and your data: * **Project versions** are saved as the agent works. You can restore an earlier version from any message in the chat. * **Source code** of git-backed projects is durably backed up on Macaly's side. * **Database snapshots** can be exported as a ZIP file from the **Database** tab whenever you want your own copy of your data. Your data is still yours, so keeping your own copies is a good habit, especially before significant changes: * **[GitHub integration](/docs/en/integrations/github)** (Pro plan and above) backs up your project's source code to a private repository * **Duplicating chats** creates an independent copy of your project as a safety point before larger changes ### AI features in your app If your project includes AI features for end users, such as chatbots, content generation, or summarization, the configuration and the outputs they produce are part of your project. Your end users need to know when they are interacting with AI, and Macaly's own in-app notice does not carry over to what you publish. [Using AI responsibly](/docs/en/security/using-ai-responsibly) covers what to add and where. ### Payments Macaly is not a payment processor and does not store or transmit card data. If your project accepts payments, use a hosted payment provider that handles cards on its own infrastructure. Avoid storing card numbers, CVCs, or other raw payment data in your project's database. ## When Macaly is the right fit Macaly is built for marketing websites, landing pages, internal tools, dashboards, MVPs, and small to medium web applications. It works well for projects where you want to move quickly and iterate based on real feedback. For projects involving highly regulated data, additional compliance work may be needed beyond what Macaly handles by default. This includes: * Healthcare data covered by HIPAA or similar regulations * Raw payment card data subject to PCI DSS * Apps directed at children under 13 (COPPA) or under 18 If your project falls into one of these areas, talking to a legal or compliance advisor early on is a good idea. Macaly can still be useful for parts of the work, while the compliance side benefits from human expertise. ## Reporting a security issue If you spot something that looks like a security issue, we'd like to hear about it. Email [support@macaly.com](mailto:support@macaly.com) with a description and steps to reproduce, and we'll review it as quickly as we can. ## Compliance and legal documents For full details on data processing, subprocessors, and contractual terms: * [Privacy Policy](https://www.macaly.com/privacy-policy) * [Data Processing Agreement (DPA)](https://www.macaly.com/dpa) * [Terms of Service](https://www.macaly.com/terms-of-service) * [AI Transparency Notice](https://www.macaly.com/ai-transparency-notice)