Security and your data

Where it’s kept

• Your documents, sheets, pictures and comments are kept in a database in Sydney, Australia, run by Supabase on Amazon Web Services. The app itself runs in Sydney too, on Vercel.
• Everything travels encrypted between your browser and Muto, and it’s encrypted where it’s stored.

Who can see what

• Your company’s admins choose who is in each project and folder, and whether each person can write or only read.
• People who only read get the versions you publish, never your working copy, and only from the folders they’ve been given.
• Words you mark as private are taken out when you publish, so they never reach a reader, not even hidden in the page.
• The database itself checks who may see and change each thing, not only the app’s screens.

What Muto’s own people can see

• Nobody at Muto opens your documents. Muto’s own tools show companies, people and plans, never anything anyone wrote.
• If you want help with something, any of your company’s admins can let Muto support into the projects they pick, to look only or to look and fix, for one day to four weeks. It ends by itself, and every document support opens or changes goes in your company’s log.

Signing in

• Nobody can make an account on their own: accounts come only from an invite.
• People sign in with a code sent by email, or with a password of at least 12 characters that mixes upper- and lowercase letters, numbers and symbols.
• Admins must also use a code from an authenticator app on their phone, and stay signed in for a week at most. Everyone else is signed out after 30 days at most.
• You can see where you’re signed in, and sign out everywhere else, from your account’s Security page.
• Repeated attempts are slowed down, and a check at sign-in stops automated attempts.

If something goes wrong

If information is lost or seen by someone it shouldn’t be, and that’s likely to cause serious harm, we tell the people affected and New Zealand’s Privacy Commissioner, as the law requires.

If you think you’ve found a security problem in Muto, please email support@muto.cloud. Please don’t test it on other people’s data.

The companies that handle data for Muto

Muto uses these services to run. Each handles information only to do its job for Muto.

• Supabase keeps Muto’s database and files, and handles signing in. In Sydney, Australia.
• Vercel runs the app and this website. The app runs in Sydney.
• Cloudflare looks after Muto’s web addresses, and runs the check at sign-in and on this website’s form.
• Resend sends Muto’s emails, such as sign-in codes and invites.
• Google Workspace holds the mail you send to Muto’s addresses.
• Lemon Squeezy, owned by Stripe, will take payments once paid plans start.

How Muto handles personal information is in our privacy policy. Questions go to privacy@muto.cloud.