Trust and security

Your data stays yours.

Mythox holds your money, your work, and your day, so it is built security first. Here, in plain English, is exactly how your information is protected.

Read the full security policy

Isolated to you

Your data is fenced off to your account by the database itself, using per-user Row-Level Security. The browser only ever sees the signed-in user's own data, and the powerful server key never reaches the browser. Privileged server credentials are kept out of generated products.

Encrypted in transit and at rest

Every connection uses HTTPS with TLS 1.2 or higher. Your stored data is encrypted at rest with AES-256 on our managed database platform. Stored provider keys are encrypted server-side, and privileged keys are blocked from generated pages.

Secrets stay server-side

API keys and tokens live in a managed secret store. They are never placed in the browser, never written into the code, and never logged.

You approve every action

Midas can't change anything without your Yes.

Never sold

We don't sell your data. Not to anyone.

Export or delete

Download your data in Settings, or delete your account. Account deletion removes your sign-in and disconnects bank access. Necessary billing records are retained under our retention policy.

You control Connections

Connected AI tools read your own approved data and save only the supported changes you confirm. Money stays read-only. Remove access any time.

Bank connections through Plaid

You enter your bank credentials into Plaid's own secure screen, so Mythox never sees or stores your bank username or password. The connection is read-only and tokenized. The access token and your data stay server-side and encrypted, isolated to your account. You can disconnect anytime, which revokes the token. US banks only.

Payments run on Stripe

Your card details are handled by Stripe, not stored by Mythox. Payments use Stripe-hosted checkout. Mythox uses payment references and verification signals. Supported creator payments use the creator's own configured Stripe account.

Two-factor authentication

Available in Settings with an authenticator app (TOTP), required to connect a bank, and protecting the administrative consoles.

Your data is isolated to you, and encrypted. The protection is built into the data layer, not just the app. That isolation, plus encryption in transit and at rest, is the foundation everything else sits on. Sharing permissions separately govern what information Midas can use. These are safeguards, not a promise that software can never have a fault.

Your bank and card details never touch us. The two places you are most careful about, your bank and your card, are handled by Plaid and Stripe on their own secure screens. Mythox works from a read-only, tokenized connection, so the sensitive credentials stay with the providers built to hold them.

Midas asks first

AI that waits for you.

Midas uses permitted account context and saved memory. Supported write actions are limited and appear for your approval. Sensitive context is restricted, and privileged keys are blocked from generated products.

HistoryLast 7 days

Added $448 to tax goalYes · Today
Moved 2 tasks to ThursdayYes · Wed
Email Lena a reminderNo · Tue
Made 4 thumbnailsYes · Mon
Cancel gym membershipNo · Sun

Access and AI · Least privilege

Least privilege, everywhere, including the AI.

People and components get only the access they need, and nothing more. That principle covers your login, our admin access, and the in-app AI, which is deliberately boxed in so it can help you without being able to touch what it should not. Supported changes require your approval.

Guardrails on the AIMidas runs under a frozen, tamper-resistant scope policy. It is read-only on money and credentials (with redaction), can only write to a tiny allow-list, never deletes, never runs raw database commands, and never exposes tokens. This is verified by automated tests.
Safer products from the BuilderGenerated products pass checks for secrets and unsafe code. Static products have no scripts by default, except for approved integrations. Generated web apps are self-contained and block unapproved remote scripts, styles, frames, and network calls. Database apps can reach their own database, while privileged keys are blocked from the delivered page.
Every release is security-reviewedEach meaningful change passes an automated security-review gate before it ships. Findings are fixed and re-checked before release.
Builder checks before deliveryGenerated files pass safety checks before delivery. Some product recipes include an AI quality review and attempt fixes. A later revision runs through safety checks again.
Account protections behind the scenesSignup risk checks and alerts, attack monitoring and reports, extra approval for sensitive admin actions, and an account deletion flow protect more than the screens you see. Account deletion removes your sign-in and disconnects bank access. Member content, private files and required business records remain in protected history under our retention policy.

Security questions? Talk to a human.

Email support@mythox.ai for anything security or privacy related, including a suspected issue.

Read the privacy policy

For the full detail, read the Privacy, Terms, and Security policy.