Security
Your data is protected.
Maia is built on enterprise-grade infrastructure with encryption at every layer. We're transparent about how your data is stored, processed, and protected.
Infrastructure Security
Maia is deployed on Vercel, which maintains SOC 2 Type II, ISO 27001, and PCI DSS certifications. The underlying infrastructure runs on AWS with automatic DDoS mitigation, Web Application Firewall (WAF) protection, and global edge network distribution.
Data Encryption
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption. This applies to database records and extracted course text. Original uploaded files are discarded after parsing. Encryption keys are managed through cloud provider key management services with access logging.
Authentication & Access Control
Users authenticate via Google SSO or single-use email magic links: no passwords are ever stored. Sessions expire server-side and can be revoked from any device ("Sign out everywhere"). Role-based access control (admin, instructor, learner) limits data exposure to what each role requires, and key admin actions — invites, role changes, assignments, and publishing — are recorded in an append-only audit log.
AI & Your Content
Maia's AI tutoring is powered via API access to language models. Maia does not use your data — conversation transcripts, uploaded documents, learning progress — to train models, and your content is processed by our AI providers (xAI for tutoring and generation, ElevenLabs for audio) under their API terms. A current subprocessor list is available on request. Content is isolated per organization and per user: conversations and uploaded materials from one organization are never accessible to another.
Payment Security
All payment processing is handled exclusively by Stripe, a PCI DSS Level 1 Service Provider. Maia never stores, processes, or transmits credit card data. Payment information is entered directly on Stripe's hosted checkout page.
Document Storage
Uploaded training materials (PDFs, DOCX, PPTX) are parsed server-side during upload and the original files are discarded: we retain the extracted text, plus any images taken from the file, needed to generate and cite courses, stored encrypted and scoped to the uploading organization. One tenant's content is never accessible to another.
Privacy & Data Governance
Maia follows GDPR-aligned data practices. Organizations can request data export or deletion for their users. We process only the data necessary to deliver the service. A list of subprocessors is available on request.
Built on certified infrastructure
Vercel
Hosting & compute
SOC 2 Type II, ISO 27001, PCI DSS
Stripe
Payments
PCI DSS Level 1, SOC 1 & 2 Type II
PostgreSQL
Database
Managed hosting with automated backups, AES-256 at rest
Straight answers
The questions security reviews actually ask: answered plainly, including where we're not there yet.
Where is our data stored?
In the United States, on Vercel (compute) and a managed PostgreSQL provider (data), both encrypted at rest. We do not currently offer regional data residency options.
Is our data used to train AI models?
No. Never by us, and our AI providers state that data sent through their APIs is not used to train their models. We can share the current subprocessor list and their terms on request.
Do you sign DPAs?
Yes. A GDPR-aligned data processing agreement with our subprocessor list is available on request for team and enterprise customers.
Do you support MFA?
Sign-in is via Google SSO or single-use email links. No passwords exist to phish. If your Google Workspace enforces MFA, that applies to Maia sign-in automatically. Native in-app MFA is on our roadmap.
Do you have your own SOC 2?
Not yet. We run on SOC 2 Type II certified infrastructure (Vercel, AWS, Stripe), and our own certification is planned. Happy to walk through our controls in the meantime.
Who are your subprocessors?
Vercel, a managed PostgreSQL provider, xAI (language models), ElevenLabs (audio), AWS SES (email), Stripe (payments), and Google (SSO). Details in our privacy policy.
Responsible disclosure
Found a security issue? We take reports seriously and respond within 48 hours. Please email us with details.
security@maia.studyHave specific security questions? We're happy to discuss your requirements.