Security and data handling

1. Who We Are

Maguyva is a code intelligence service operated by UT INTERNATIONAL PTE. LTD., a company registered in Singapore. Maguyva is a cloud service: customers connect via the MCP endpoint and authorize repositories; tools do not modify customer repositories.

2. What Data We Handle

When you use Maguyva, we handle three categories of data:

• Account data: name, email address, and GitHub OAuth token used to access repositories you authorize
• Code data: source code stored to serve file content and power search; abstract syntax trees; symbol graphs; and semantic embeddings derived from your code
• Usage data: which tools you call, timestamps, and aggregate query patterns

Customer repository data is separate from the public website crawl policy. Website AI crawl permissions do not apply to private customer code.

3. Where It Runs

Customer source code and derived index data are stored in Maguyva service infrastructure on Supabase (PostgreSQL) in AWS US regions. The public website and edge delivery run on Cloudflare (CDN, edge compute, DNS). For embedding generation, AST-aware semantic code chunks — not complete files or repositories — are sent to Voyage AI (a MongoDB subsidiary). Those embedding requests exclude customer-identifying metadata such as repository names, usernames, organization identifiers, and file paths.

4. Access Model and Isolation

Product access is controlled through organization- and namespace-scoped access controls. Indexed repository data for one customer is not exposed to other customers. API keys are validated against stored metadata and repository access restrictions. Maguyva operators may access repository data only as needed to operate, secure, or support the service. Data in transit uses HTTPS/TLS. Indexed repository data is stored on managed infrastructure with storage-level encryption at rest. Source and derived index data remain readable to the service where required for search, file retrieval, support, and security operations.

5. Subprocessors

We use the following services to operate Maguyva:

• Supabase (database hosting, AWS US regions)
• Cloudflare (CDN, edge compute, DNS)
• Voyage AI, now part of MongoDB (embedding generation — receives AST-aware code chunks without customer identifiers, not complete files or repositories)
• Stripe (payment processing)
• GitHub (OAuth authentication and repository access)
• Umami (cookieless website usage analytics — aggregate metrics only, no personally identifiable information)

6. Retention and Deletion

Active accounts: data is retained while your account is active. When you disconnect a repository or cancel your account, active indexed source code and derived data are removed from service systems within 30 days, with residual backup copies expiring within 90 days. Billing records are retained for 7 years as required by law. We do not train on customer code. We claim no intellectual property rights over customer code.

7. Vulnerability Reporting

If you believe you have found a security vulnerability in Maguyva, contact security@maguyva.ai. Preferred language for reports is English. Our machine-readable contact and disclosure policy lives at /.well-known/security.txt (RFC 9116).

8. Related Documents

For full legal and policy detail, see:

• Privacy Policy — how we collect and use personal and repository data
• Terms of Service — service agreement
• security.txt — canonical vulnerability contact (RFC 9116)