Security overview
Sail is built for companies that can’t send their work through a consumer AI app. This section answers the questions a security team asks, plainly, including the limits.
These pages describe Sail itself, wherever it runs. If Msty hosts Sail for you, ask Msty for the hosting details as well: regions, sub-processors and the data processing agreement.
At a glance
Section titled “At a glance”| Question | Short answer |
|---|---|
| Is our data mixed with other customers’? | No. Each Sail install serves one company, with its own database and file storage. |
| Where does our data live? | In your Sail’s Postgres database and file volume. Self-hosted, that’s on your servers. |
| Does Sail send data to Msty? | No. A self-hosted Sail never calls Msty and sends no telemetry. |
| Who sees our prompts? | Your Msty Nexus and the model providers it’s set up to use. Sail holds no model keys. |
| Can admins read people’s chats? | No. Nobody in Sail can read another person’s chats or memories, owners included. |
| How do people sign in? | Through your own identity provider, over OpenID Connect. Sail stores no passwords. MFA stays in your provider. |
| What’s logged? | Who changed what, in an audit log. Never message content. |
| Is data encrypted? | In transit, with HTTPS. Stored secrets are encrypted by Sail. Chats and files rely on your disk and backup encryption. |
| Can people delete their data? | Yes. They can export everything, and ask for erasure. An admin approves. |
| Does the AI run code? | No. Sail never runs code a model writes. Files are made and read by Sail itself. |
| Is it certified? | No certifications are claimed yet. |
Read more
Section titled “Read more”- Data and privacy: what’s stored, who can see it, what leaves Sail, and how it’s deleted.
- How Sail is protected: sign-in, sessions, encryption, AI-specific safeguards, the audit log, and how Sail is built and shipped.
Report a security issue
Section titled “Report a security issue”Found a vulnerability in Sail? Report it to Msty privately before sharing it anywhere else. Self-hosted installs publish their own contact at /.well-known/security.txt. Set yours with SAIL_SECURITY_CONTACT (see Configuration).