How we keep your computers yours

Last updated: October 2, 2026

Your computers hold your files, your logins, and whatever your agents do with them. This page says how Mandala Computer protects them, and how to tell us about a problem.

Isolation

Each computer is a virtual machine behind hardware virtualization, with its own kernel, its own network policy, and its own credentials. Computers can't see each other, other customers, or our infrastructure. Nothing is a shared container.

Your account and keys

• Multi-factor authentication (MFA) is available on every account: turn it on under Settings → Security, and sign-in then asks for a code from an authenticator app, with one-use recovery codes if you lose it.
• Each API key works in exactly one workspace, and you can revoke any key at any time.
• The hosted MCP server signs in through your browser with OAuth instead of an API key. You can revoke it under Settings → Connected apps.
• The live-view embed takes a watch-only URL or a computer's own token. Your API key never goes in the page.

Secrets and data

• This site, the dashboard and the API are served only over TLS; a plain HTTP request is redirected to HTTPS.
• Secrets you store with us are encrypted, and no API route can read a value back once it is stored.
• A computer that holds secrets saves its memory to disk only on a host that encrypts it on the way.
• Webhook deliveries are signed to the Standard Webhooks scheme, and you can rotate the signing secret without missing a delivery.

Where it runs

On servers we own and operate ourselves, in the United States, not on a hyperscale cloud. The few companies that do handle your data, and what each one handles, are listed on our subprocessors page. Access to production systems is restricted and audited. If we learn of a breach affecting your data, we will notify you. Current service status is on our status page.

Reporting a vulnerability

Email [email protected] with what you found and how to reproduce it. Please test only against your own account and computers, don't access other people's data or disrupt the service, and give us a reasonable time to fix the problem before you disclose it. The same contact is published in security.txt.

To report abuse coming from a Mandala computer, write to [email protected].