Security & data privacy
An honest account of how MaximaLabs handles your data — and where we're headed on compliance.
Current posture
- ✓Browser-based — no desktop agent or license server to install or patch.
- ✓Your data lives on a dedicated server (local Postgres + filesystem), reached only through the app and API.
- ✓Sessions use a signed, httpOnly cookie; API keys and secrets live in environment config, never in the repo or the client.
- ✓Real per-organization SAML 2.0 SSO (Okta, Azure AD, Ping) alongside Google SSO and email/password — an org admin configures their own IdP directly in the app, no support-assisted setup required.
- ✓Encryption in transit (HTTPS/WSS) to the server and to the one external dependency, the Anthropic API.
- ✓Nightly database dumps plus offsite object-storage backups; simulations are yours to export (CSV/PDF) at any time.
We're building toward SOC 2 Type II. We don't claim certifications we don't hold — if a formal security review is a prerequisite for your team, tell us where you are in procurement and we'll share our current controls and timeline.
Terms & contact
Full terms of service and a data-processing agreement are available on request. For security disclosures or compliance questions, contact contact@maximalabs.io.
Frequently asked questions
Are you SOC 2 certified?
Not yet — see the note above. Ask us where you are in procurement and we will send the controls we hold today rather than a certification we do not.
Where does our data actually live?
On a dedicated server we operate — a local PostgreSQL database and local file storage, reached only through the app and its API. Traffic to it is encrypted in transit, and there is no third-party data warehouse in the path.
Does our flowsheet get sent to Anthropic?
Only when you use the AI copilot, and only then: a copilot request sends the simulation context needed to answer it to the Claude API over an encrypted connection. Anthropic acts as our subprocessor and does not use it to train models, and we do not train models on your simulation content either. Nothing else leaves the server — the solver itself makes no outbound calls, so a simulation runs identically with the AI switched off or unreachable.
Can we run it entirely on our own infrastructure?
Yes, as an Enterprise deployment. In self-hosted mode the solver, the database, file storage and every stream and flowsheet value stay on your infrastructure for the whole run.
How do you handle single sign-on?
Per-organization SAML 2.0 against your own identity provider — Okta, Azure AD and Ping are in use — configured by your admin in the app rather than through a support ticket. Google SSO and email/password are also available.
If we leave, can we take our work with us?
Yes. Every simulation exports to CSV, Excel and PDF, the flowsheets themselves are JSON you can pull through the API or the Python SDK, and deleting a simulation or closing an account removes the content from active systems.