Private access
Studio pages and business data require authentication. Passwords are stored as salted password hashes. Production sessions use Secure and HttpOnly cookies.
Private files
Workspace files are held in private object storage. Authorized media can use short-lived signed links, so sharing a generated link also grants access until it expires.
Backups and recovery
The deployed Studio has a daily encrypted database backup and a tested restore procedure. The recovery key is kept separately from the object-storage backup. These controls are not a promise of zero data loss or a published recovery-time guarantee.
Human control
Approval is a distinct action. Pausing automation, inspecting versions and checking the actual output remain part of the workflow. AI output can be wrong and needs review.
Report a concern
Contact office@merlinwild.com with a description and steps to reproduce. Do not send passwords, API keys or another customer’s private information. No independent security certification is claimed here.