Mobius coordinates agent work across humans, systems, and customer-controlled workers. Security is built around clear tenant boundaries, least-privilege access, encrypted transport, and operational controls that keep customer data and credentials scoped to the work they support.
This page summarizes our current security practices. It is intended as an overview for customers evaluating Mobius and does not replace a written agreement, data processing addendum, or security questionnaire response.
Security overview
Mobius is a multi-tenant cloud service that stores the records needed to coordinate organizations, projects, loops, runs, credentials, workers, and audit history. Tool, code, and model work runs through project workers or managed environments. If a customer chooses, workers can operate inside the customer's own environment while Mobius coordinates the run.
Execution is scoped to the project credential or environment lease. The connected worker or managed environment performs the work and returns the result to Mobius.
Infrastructure
- Frontend: served through Cloudflare with automatic TLS.
- Backend: runs on Google Cloud with managed TLS, autoscaling, and containerized workloads.
- Authentication: Clerk provides authentication, session management, and organization membership.
- Payments and billing: Stripe handles payment and billing workflows.
Encryption
- Traffic to Mobius is encrypted in transit using HTTPS.
- Customer Data is encrypted at rest by our cloud providers.
- API keys and API client credentials are stored hashed or otherwise protected so plaintext secrets are not shown again after creation.
Access control
Customer access
- Users are members of one or more organizations, and API requests resolve to an organization before access is authorized.
- Administrators can define roles and assign them to members, controlling which projects and capabilities each member can use.
- Machine-to-machine access uses project API clients with rotatable API keys. Role assignments on the API client determine what each credential can do.
Operator access
- Production access is limited to a small number of operators.
- Operator access uses SSO and MFA where supported and is scoped to the minimum privileges required for operations, support, and incident response.
- Significant administrative and service actions are recorded for audit and investigation.
Tenant isolation
Mobius is multi-tenant by default. Records are scoped by organization and project, and strict access controls use those scopes before data is returned. An identifier alone is not enough to read across tenants. Enterprise plans can also support dedicated or single-tenant deployments, including deployment into your own cloud account.
Worker trust model
Workers are processes that open an outbound HTTPS connection to Mobius and execute actions for a project. Customer-controlled workers run in your environment. Managed environments, when enabled, are execution places associated with the run or agent.
Because customer-controlled workers connect outbound, no inbound firewall holes are required to put a worker on a private network. Workers authenticate with project API client credentials that you issue from your Mobius account.
You are responsible for securing worker hosts, keeping customer-issued credentials confidential, and limiting the scope of what a worker is permitted to do in your environment. We recommend issuing a dedicated API key per worker deployment so credentials can be rotated independently.
Operational security
- Application and platform logs are collected and retained for security monitoring, abuse investigation, and incident response.
- Dependencies are tracked and updated as part of ongoing maintenance.
- Code changes go through version control and automated checks before deployment.
Incident response
We monitor the Services for availability and security events. If a security incident affects Customer Data, we will notify affected customers without undue delay, in accordance with applicable law and any customer agreement, and provide information about the incident, our response, and remediation steps.
Responsible disclosure
If you believe you have found a security vulnerability in Mobius, email support@mobiusops.ai. We ask that you:
- Give us a reasonable amount of time to investigate and fix the issue before any public disclosure.
- Avoid accessing, modifying, or deleting data that does not belong to you, and avoid degrading service for other customers.
- Include enough detail, such as reproduction steps, affected endpoints, and expected versus observed behavior, for us to reproduce the issue.
We will acknowledge receipt, keep you informed of our progress, and credit you in our advisory when the issue is resolved, unless you prefer to remain anonymous.
Compliance and enterprise questions
We are actively investing in formal compliance programs as we grow. If you are evaluating Mobius for an enterprise deployment and need our current security documentation, a Data Processing Addendum, sub-processor list, or answers to a vendor questionnaire, contact support@mobiusops.ai.