Security
Last updated: 14 October 2026
Mugatu AI, Inc. (“MugatuAI”, “we”, “us”) — publisher of Cloakworks by Mugatu AI.
Cloakworks is built so that sensitive prompt content never leaves your device unmasked. This page explains where data goes, what we store, and how to reach our security team.
1. Data flow
You type a prompt
On your device
Receives masked text only
Receives the license key only
Detection and masking run entirely on the endpoint. Prompt text, files and the original values that were masked are never sent to Mugatu AI. The licensing service receives only your license key to confirm the seat is valid.
2. What the fleet dashboard stores
For Regulated Enterprise Fleet customers, the dashboard stores counts and categories only — for example, "12 API keys masked this week." It never stores prompt text, masked values, files or screenshots.
3. Encryption
All traffic to our services uses TLS 1.2 or higher. Account, license and dashboard records are encrypted at rest. Prompt content is processed in memory on your device and is not written to our systems.
4. Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Stripe | Payment processing for Professional seats | United States |
| Render | Hosts the licensing service (license key activation) | United States |
| Lovable Cloud | Website hosting and account / access-request records | United States |
| Resend | Transactional email delivery (access keys, notices) | United States |
| Google Analytics | Aggregate website usage analytics (website only, never the product) | United States |
None of these providers receive prompt content.
5. Vulnerability disclosure
Found a security issue? Email security@mugatuai.com with steps to reproduce. Please give us reasonable time to fix it before public disclosure. We will not pursue good-faith research.
Security questionnaires
Need a SIG, CAIQ or your own questionnaire completed? We'll respond directly.