Security at Master
This page is maintained by the Master team to answer common security and privacy questions about the Master platform. It is not an independent certification.
Master operates the platform — the agent, hosting, the database service, and the controls listed below. The application owner is responsible for what they build with it: their own access policies, the data they collect from end users, and any compliance commitments they make to their customers. This page describes the platform controls Master provides today; it does not describe controls inside any individual app built on Master.
Authentication & access
Sign-in options
Email + password, magic link, Google, GitHub and SAML 2.0 SSO (Enterprise) for the Master dashboard.
Apps built on Master can configure their own auth methods independently.
Workspace controls
Role-based access at the workspace, project and environment level. SCIM 2.0 provisioning available on Enterprise.
Row-level security is enabled by default on every new table created through the platform.
Platform & hosting
Hosting & residency
The Master dashboard, agent and edge runtime are hosted on Cloudflare Workers. Customer databases and storage are hosted on Supabase, with a choice of EU (Frankfurt) or US (Virginia) region.
Transport & at-rest encryption
TLS 1.2+ in transit between the user, edge and database. At-rest encryption is provided by the underlying hosting providers (Cloudflare for object storage, Supabase for Postgres and bucket storage).
Data we collect
What Master stores about your account
Account profile (name, email, hashed password or IdP claim), workspace and project metadata, prompts and conversation history with the agent, generated code and assets, billing identifiers from Stripe, and operational logs needed to run the service.
Prompts and your project data are not used to train third-party models. The AI Gateway forwards inference requests to model providers under their respective enterprise terms.
Subprocessors
Vendors who process data on Master's behalf to deliver the platform. App owners must independently confirm this list aligns with their own data agreements.
| Vendor | Purpose | Region |
|---|---|---|
| Cloudflare | Edge hosting, CDN, DDoS protection | Global |
| Supabase | Managed Postgres, auth, storage, edge functions | EU / US |
| OpenAI, Anthropic, Google | LLM inference via the AI Gateway | US |
| Stripe | Subscription billing and payment processing | US / EU |
| Resend | Transactional email delivery | EU / US |
| Sentry | Error monitoring (no end-user PII) | EU |
Cookies & analytics
Master uses a session cookie to keep you signed in and a first-party analytics cookie to measure marketing-site usage. We do not run third-party advertising trackers.
Retention & deletion
Active project data is retained while the workspace exists. Deleted projects are purged from primary storage within 30 days and from backups within 90 days.
Privacy requests
To exercise access, correction or deletion rights for your Master account, contact privacy@master-magic.dev. End-user requests for an app built on Master should be directed to that app's owner.
Audit log
Enterprise workspaces include an exportable audit log of administrative actions (membership changes, role grants, deployments). The log can be streamed to a SIEM via webhook.
Incident & vulnerability reporting
Report security issues to security@master-magic.dev. We acknowledge within one business day and coordinate disclosure. Please do not test against production data you do not own.