Security

Meww holds the keys to your company’s systems, so this page says what protects them and, as plainly, where that protection stops.

Credentials

• Every connection credential is encrypted before it is stored, with keys that can be rotated without losing access. The application will not start without a key.
• Tokens stay on the server. The model sees tool descriptions and results, never a token. A token is not put in a prompt, a tool argument or a log line.
• The browser never talks to the API. Only the web app’s own server does, carrying your session.
• Passwords are hashed with argon2id and must be at least 15 characters. Failed sign-ins are limited per account, and the answer does not reveal whether an email has an account.

What the agent can do

By default a question may use only the tools a connected system itself declares read-only. Others are left out of the list the model is given, so it cannot call one by naming it. Gmail is connected with Google’s read-only scope, so its token cannot send, change or delete mail.

Meww searches live and keeps no copy of your systems’ data, so there is no second store of it to protect, and an answer reflects what the system says now.

Who sees what

• Accounts are created by whoever runs the service; there is no public sign-up.
• Connections and conversations are private to the person who made them. Asking for another person’s conversation gets the same answer as asking for one that does not exist.
• A session ends when you sign out, after a spell unused (eight hours by default), at a fixed maximum age (seven days by default), or when your password is reset. Signing out revokes it on the server.
• Pages are served over HTTPS with HSTS, and none may be shown inside another site’s frame.

Where the protection stops

• The read-only setting is a guardrail, not a boundary. It relies on what each system says about its own tools. What a connection can really do is decided by the permissions you grant it. GitHub, for one, has no read-only permission that covers private repositories, so the token Meww receives can write; the guardrail is what stops Meww from using that.
• Text it reads can try to give it orders. A message, ticket or email might say “ignore your instructions”. Meww tells the model that retrieved text is data and not instruction, and removes text that Gmail hides from the reader. That held in our tests, but it is a measure of the model’s behaviour, not a guarantee.
• Disconnecting deletes Meww’s copy of a credential. It does not revoke it at the system.

If you want the data and the model to stay inside your own network, Meww can run there: self-hosting.

Report a problem

If you think you have found a security problem, tell us through the request-access form and begin the note with “Security report”. Please do not include a secret in it.