Security you can check for yourself.
Your team runs on your own {{device}}, inside a sandbox the operating system applies before any Maxiful code starts. This page says what that boundary holds, what it does not, and what we do not claim.
The operating system puts your team in a sandbox.
On macOS, the background process that runs your agents is started by the system through its own sandbox tool, with a profile that denies everything and then grants what the install needs. It is in place before any of our code runs. On Windows the equivalent is an AppContainer, and it is best effort: if the container cannot be created the app starts without it, and Mission Control reports that the isolation is not active.
- Writes are confinedYour agents write inside the install directory, their own working directories and a small number of helper folders. They cannot rewrite the sandbox profile, the configuration, or the Mission Control code they are served from.
- Reads are allowlistedThe profile names the system directories the software needs and the install's own paths. Your home directory is not one of them, so your documents and your keys sit outside the boundary.
- It does not depend on the permission levelThe four levels below change what an agent may do. They do not change whether it is sandboxed. The wrap is the same in all of them.
- The profile is a file you can readIt sits on your startup disk, in a folder called .lanoko-sandbox, under your install's name, as a plain text file called gateway.sb. Open it and hold this page to it.
What the sandbox does not do.
This is the half most security pages leave out, and it is the half a careful reader checks first.
- It is not a virtual machineIt is an operating-system sandbox profile, not a VM and not a container. If anyone tells you otherwise about our product, including us, they are wrong.
- One boundary for the team, not one per agentA single background process hosts every agent, and one profile wraps it. Each agent has its own working directory, and all of them sit inside the same boundary, so your agents are not isolated from each other.
- Outbound traffic is limited by port, not by destinationA sandbox rule cannot name a hostname, so a permission that needs the web opens that port rather than a list of sites. Controlling the destination would take a filter we have not built. We would rather write that here than let the page imply we have it.
- A shell is allowed inside the boundarySo we do not claim your agents can only run an approved list of programs. What holds them is the filesystem and the ports, not a list of names.
- It can be skippedSeveral things can stop it: no sandbox tool on the machine, a profile that could not be generated, or your own explicit acknowledgement that you want to run without it. The app records whether the wrap is in place.
Four levels, and what each one actually means.
You set a level per agent. The words mean exactly this and nothing more.
- TrustedRuns without asking. For the machine and the job where that is what you want.
- GuidedThe default. A fast model reviews each command before it runs. That is a model and not a person, which is why we do not call it an approval, and if you put an agent on that same fast model it is reviewing itself.
- Ask firstThe command waits for you. If nothing is connected that can ask you, the command is dropped instead of run, so this level fails closed.
- Read onlyIt can read, browse and report, and it cannot run commands or write files. What it may do with a tool you have connected is set by the switches below, not by this level.
A level takes effect for an agent once you have opened that agent's page in Mission Control. Until then the runtime is on its own default, which is no command gate and no reviewer, and Mission Control tells you the level is not enforced rather than showing you the one you picked.
The answers you give at setup follow every agent.
Ten switches in the setup wizard become tool denials on every agent on the machine, including the ones your Chief of Staff hires later. They are applied before the model is called, so an agent cannot talk its way past them.
Four things are always on and are not switches: AI reasoning, messaging you, reaching Maxiful's own services, and the agent's workspace.
What leaves your {{device}}, and what does not.
Your files, your conversations and your team's memory stay on your machine. The prompt for each AI call is routed through Maxiful's model proxy to the AI provider under no-training terms, and it can include an excerpt of the file or email being worked on. We record only usage metadata, never the content. Memory search runs on your machine too, wherever it can: on a machine with too little memory or disk to run the index, and on a shared machine where it cannot run at all, it goes through the model provider instead, and the app says so. The transparency page itemises every exit rather than summarising them away.
Installers, updates and marketplace items.
Three ways code reaches your machine, and what each one verifies.
- Signed installers with a published checksummacOS is notarized by Apple and Windows carries a Certum OV certificate from PolyTrader Ltd. The download feed publishes the SHA-256 of the exact file we built and whether that build came out signed, so you can check the bytes you received before you run them. The macOS app leads, and the Windows app follows a few versions behind.
- Updates verified against a key inside the appMission Control's own updates are signed, and the verification key ships in the app rather than arriving with the update. An update that does not verify is refused rather than applied.
- Marketplace items are signature-checked, and the scan is best effortA package whose signature or contents do not match what we published is refused. The automated content scan is a separate step, and if your machine cannot reach the scanner it reports that it could not check rather than reporting a pass.
Where your logins live.
The credentials for the tools you connect go into a secret store on your own machine. They are not written into a configuration file and never passed on a command line, where another process could read them.
- Not all in one place, and we will not pretend otherwiseOn macOS your Maxiful session sits in the login keychain. Some tools keep their own login in their own file, because that is where that tool looks for it. What matters is which machine they are on, and that is yours.
- We have no code path that reads themNothing in the product sends your tool logins or your keys to us. That is a statement about the code, which you can hold us to, rather than a promise about our intentions.
No standing access, and a real uninstall.
- No standing access to your machineWe cannot see or reach what is on it. Hands-on support happens only when you grant an explicit, time-limited session.
- Use Remove from this computerIt removes the background process, the scheduled updater, the install's secrets directory and the device key in your keychain. Dragging the app to the Trash removes only the app and leaves the background process running with everything it holds, so use the uninstaller.
- Diagnostics are opt-out and carry no contentA handful of setup events tell us whether installing worked. They identify the install by a random number, carry nothing about you or your work, and you can switch them off.
On certifications, plainly.
We hold no formal certification such as ISO 27001, ISO 9001, or BSI. Our security rests on architecture, keeping your data on your own machine, rather than on a certificate on the wall. A firm handling client data deserves the honest version, not a badge that implies more than it means.
- We have had no external penetration test and we hold no SOC 2 report. If a page of ours ever shows a badge implying otherwise, it is a mistake and we would like to hear about it.
- What we can state as fact: Maxiful is a product of PolyTrader Ltd, registered in England and Wales, a data controller under UK and EU data protection law with a designated representative in the EU.
Found a problem?
Write to security@maxiful.ai. A report about our software reaches a person rather than a queue. If it is urgent, say so in the subject line.
Read the rest before you decide.
The architecture in full, and the itemised list of what stays on your {{device}} and what leaves it.