Data Security

Our approach

Malloy Studio uses administrative, technical, and organizational safeguards designed to protect account information, prompts, uploaded assets, generated templates, and exports. Security is an ongoing process, and no internet service can guarantee that a breach will never occur.

Data in transit and at rest

• Production web and API traffic is encrypted in transit using HTTPS.
• Supported databases and object storage use encryption at rest.
• Private files are delivered through signed, time-limited URLs rather than permanent public links.
• Rendered export files expire after seven days, and export download links expire within 24 hours.

Account and tenant safeguards

• Authorization checks scope templates, generation sessions, exports, and asset-library items to their owning account.
• Passwords are stored as hashes. Google sign-in is available for users who prefer federated authentication.
• Service access and internal credentials are limited according to job responsibilities and operational need.
• Rate limits, plan checks, monitoring, and error reporting help detect misuse and operational failures.

ChatGPT and MCP security

• A connected AI client receives access only after the user signs in and approves the requested Malloy permissions.
• MCP access tokens are audience-bound and expire after one hour. Refresh tokens expire after 30 days and can be revoked.
• Malloy stores cryptographic hashes of MCP refresh tokens rather than usable refresh-token values.
• Interactive previews use separate, composition-scoped tokens that expire after four hours.
• Malloy tools do not request the user's full ChatGPT conversation history and operate on the specific inputs sent with a tool call.

AI and service providers

Malloy sends prompts and only the references or assets needed for a requested generation to the applicable AI provider. Other vetted providers support hosting, storage, rendering, monitoring, payments, analytics, email, and customer support. We limit these disclosures to what is needed for the relevant service. See our Privacy Policy for the data categories, recipients, retention periods, and user controls.

Your role

Use a unique password, protect your email and connected AI accounts, disconnect clients you no longer use, and do not include passwords, API keys, authentication codes, payment-card data, government identifiers, or health information in prompts, file names, or uploads.

Report a security concern

If you believe you found a vulnerability or that your account has been compromised, contact support@malloy.sg with enough detail for us to investigate. Please do not access, change, or download data that does not belong to you.