Question 1

Where is MACAW data stored?

Accepted Answer

MACAW data is stored in two locations:

1. Control Plane (MACAW-managed):
- Runs in AWS
- Stores: Identity mappings, agent registry, policies, attestation decisions, audit logs
- Does NOT store: LLM prompts, tool parameters, response content

2. Your Environment (Client/App):
- LLM prompts and responses flow directly to/from LLM providers
- Tool parameters stay between your app and MCP servers
- Enforcement happens at endpoints in your environment

Key insight: The control plane is a metadata la

Question 2

Does MACAW access my LLM prompts?

Accepted Answer

No. MACAW does not see, store, or process your LLM prompt content.

Your App                    MACAW Control Plane         LLM Provider
    │                              │                         │
    │──── Policy check ───────────>│                         │
    │     (model name, user ID)    │                         │
    │<─── Allow/Deny ─────────────│                         │
    │                              │                         │
    │──── Prompt ───────────────────────────────

Question 3

What data does MACAW store?

Accepted Answer

MACAW stores metadata and configuration:

Stored in Control Plane:

| Category | Examples |
|----------|----------|
| Identity mappings | User emails, IdP claims, role assignments |
| Agent registry | Agent IDs, public keys, connection status |
| Policies | MAPL policy JSON documents |
| Attestation records | Approval decisions, attestation keys, timestamps |
| Audit logs | Event type, principal, resource, outcome, policy_id |

Note: Some parameter data may appear in audit logs for policy decisi

Question 4

Is MACAW GDPR compliant?

Accepted Answer

MACAW's architecture supports GDPR compliance:

Privacy by Design:
- Actual invocations/executions happen at your endpoints
- Control plane stores metadata and policy decision logs
- Data minimization: we only store what's needed for policy enforcement and audit

GDPR-relevant features:
- Data export (Article 20 - portability)
- Data deletion available (Article 17 - erasure)
- Audit logging for accountability (Article 30)
- Security measures (Article 32)

Your responsibilities as Controller:
- Y

Question 5

What certifications does MACAW have?

Accepted Answer

Current status: No certifications yet. Building toward SOC 2 Type II as the company matures.

Infrastructure:
- Built on AWS with inherited AWS compliance certifications
- AWS is SOC 2, ISO 27001, HIPAA-eligible certified

Security practices:
- TLS 1.2+ for all communication
- AES-256 encryption at rest
- API keys hashed (never stored plaintext)

For compliance documentation or audit support: Contact support@macawsecurity.com. See also macawsecurity.ai/security for current security practices.

Question 6

How is data encrypted?

Accepted Answer

MACAW encrypts data at multiple layers:

In transit:
- TLS 1.2+ for all API communication
- HTTPS enforced for Console and API endpoints

At rest:
- AWS-managed encryption for storage
- Database encryption enabled

Application-level:
- API keys: SHA-256 hashed before storage (original never stored)
- Audit logs: Optional cryptographic signing (hash-chained tamper-evident modes)

Your application data:
- Stays in your environment
- Your responsibility to encrypt as needed

Question 7

How are API keys secured?

Accepted Answer

API keys are secured with industry-standard practices:

Storage:
Only the SHA-256 hash is stored - the original key is NEVER stored. This means:
- We cannot retrieve your key if lost
- A database breach wouldn't expose usable keys

Additional controls:
- Keys scoped to workspace
- Optional expiration date
- Revokable via Console
- Usage logged for audit

Best practices:
1. Store keys in environment variables or secrets manager
2. Never commit keys to source control
3. Rotate keys periodically
4.

Question 8

How long is data retained?

Accepted Answer

Data retention by tier:

| Tier | Log Retention |
|------|---------------|
| Developer | 14 days |
| Team | 30 days |
| Enterprise | 90+ days (configurable) |

Configuration data:
- Policies: Until deleted
- Agent registry: Until agent unregisters
- API keys: Until revoked

After retention period:
- Automatic deletion from active systems
- No recovery possible after deletion

Enterprise: Custom retention policies available for compliance requirements.

Compliance & Privacy