How Magrios handles your data, your team, and its AI

Data we touch — and data we never touch

• Research reads public web pages only. Magrios researches your market by reading publicly accessible pages — your public site and the pages that rank for your buyers' questions. It never scrapes private, gated, or paywalled data, and crawler opt-outs are honored.
• No access to your systems. Magrios needs no tracking script, analytics connection, CRM integration, or code change to produce its research. You provide a domain and optional business context; that is the entire input surface.
• Payment data never touches our servers. Checkout and card handling run entirely on Stripe or Razorpay; Magrios stores subscription state, not payment instruments.

Tenant isolation and access control

• Fail-closed workspace boundary. Every request resolves its user, workspace, and role server-side from a signed session; anything unresolved is denied. Requests for another tenant's resources return 404 — the system does not confirm what it will not show.
• Role-based access control. Five roles — owner, admin, editor, analyst, viewer — with permission floors that deny by default. Billing actions are owner-only. Membership changes happen only through explicit invitation acceptance or an owner's decision on a join request; nothing auto-joins a workspace.
• Reports are private to their workspace. Sharing a report is an explicit action, gated by approval and an access code. The public sample reports are a separate, curated set.
• Tested, not asserted. Tenant isolation and RBAC are covered by dedicated automated test suites (isolation, permission floors, invitation and join-request ledgers, route-level authorization) that run on every change.

Application security

• TLS with HSTS on all production traffic.
• Content-Security-Policy, X-Frame-Options DENY, nosniff, and strict referrer policy on responses — pinned by automated tests.
• CSRF protection on state-changing requests; signed session cookies; authentication via WorkOS (SSO-capable).
• Rate limiting on cost-bearing public endpoints.
• Automated backups with restore verification in the test suite, and a documented disaster-recovery runbook.

Responsible AI and evidence standards

AI in Magrios reads, extracts, classifies, and scores real evidence — it never invents it. That rule is enforced structurally, not aspirationally:

• Every claim in a report links to the source page it came from; the evidence explorer is open in the public samples so you can verify this before paying.
• When something is not publicly knowable, reports say “no public evidence found” instead of guessing.
• Published knowledge content passes mechanical fabrication gates (unsourced statistics are rejected) plus independent editorial and commercial review — no writer reviews their own work.
• Benchmarks are locked between scans, so measured change is real change; declines are reported as declines.
• Recommendations expose decision traceability — evidence, sources, confidence with its basis, impact, action — never model chain-of-thought.

Subprocessors

What we don't have yet — stated plainly