MAIA is built on Cloudflare's global infrastructure. Here's how your data is protected at every layer.
Encryption in Transit
All connections to MAIA use TLS 1.3 encryption. This applies to the website (maiaos.ai), the app (app.maiaos.ai), and the API (api.maiaos.ai). Your data is encrypted between your browser and Cloudflare's edge network.
No Persistent Servers
MAIA runs on Cloudflare Workers — serverless functions that execute on demand. There is no traditional server to compromise. Each request runs in an isolated environment that is destroyed after execution.
Session Isolation
Each rehearsal session runs in its own Durable Object — a single-threaded, isolated execution environment. Navigator A's session cannot access Navigator B's data. Session IDs are UUID v4 (122 bits of entropy — computationally unguessable).
Secret Management
API keys, OAuth credentials, and signing secrets are stored as Cloudflare Worker Secrets — encrypted at rest and injected at runtime. They never appear in source code, logs, or client-side responses.
Authentication
Passwords are hashed with PBKDF2 (100,000 iterations, SHA-256). Passkeys use ECDSA P-256 with device-bound private keys. JWTs are signed with HMAC-SHA256 and expire after 24 hours.
Payment Security
All payment processing is handled by Stripe. MAIA never sees, stores, or processes credit card numbers. Stripe webhook signatures are verified using HMAC-SHA256 with timing-safe comparison.