Security

Security you can trust

One customer per Mac, no open ports, encrypted credentials, and a status page built from real measurements. Everything on this page exists and can be checked.

1 : 1

One customer per Mac

AES-256

Credentials at rest

TLS 1.3

Everything in transit

Inbound ports open on nodes

Dedicated hardware, one tenant

You rent a whole Mac mini. Nothing is virtualised and nothing is shared.

Bare-metal Apple Silicon Mac mini — no hypervisor, no co-tenants

A fresh macOS account is created for you at provisioning

Operator account is separate; customer account is a standard (non-admin) user

Hardware located in Tbilisi, Georgia; physical access limited to Macyou staff

Nodes run macOS Sequoia with automatic updates disabled — you control reboots

Nodes stay on wired Ethernet — no Wi-Fi in the path

Network

Nodes are reachable only through authenticated tunnels. No port on a Mac is exposed to the internet.

All ingress (Browser Desktop, Screen Sharing, SSH, file transfer) via Cloudflare Tunnel

Zero inbound ports opened on the node's own network

Per-deployment hostnames — each Mac has its own ingress names

Remote desktop media is DTLS-SRTP encrypted WebRTC, direct peer-to-peer where the network allows

TURN relay fallback with per-session credentials

Cloudflare in front of all node ingress

Encryption

Credentials are stored encrypted on our side, and every hop is encrypted.

Mac passwords and SSH keys stored AES-256-GCM encrypted, unique IV per secret

Passwords are not emailed — revealed on demand in the dashboard only

TLS 1.3 for the website, dashboard and API

Internal SSD hardware-encrypted by Apple Silicon (Secure Enclave keys)

Remote desktop tokens are short-lived (5 min) and valid for one Mac only

Screen-sharing (VNC) sessions run over the same encrypted tunnel

Access control

Key-based access by default, audited on our side.

SSH: key authentication only, password login and root login disabled

Screen Sharing and Browser Desktop bound to your deployment's credentials

Every account action written to an activity log you can review

Model API keys stored as SHA-256 hashes — plaintext shown once and not kept

Restart Mac from the dashboard — the only sanctioned reboot path

Data lifecycle

Your data lives on your Mac. When the Mac is released, it is erased.

No Macyou-side copies of your files — we do not take backups of your Mac

You own backups: Time Machine, iCloud, or any tool of your choice works

On teardown the tenant account and its home are deleted; we request macOS secure erase and record the verified outcome of every teardown

Erasure happens after a grace period with a countdown shown in the dashboard

Data residency: Georgia (EU-adjacent); GDPR-aligned handling, DPA available

Telemetry about your connection quality is retained for 14 days, then purged

Monitoring

We watch the platform, not your screen.

Node heartbeat every minute; stale nodes are flagged automatically

Per-second connection quality telemetry — visible to you in the dashboard

Public status page at macyou.co/status from real measurements

Incident history published on the status page

Abuse reports handled via macyou.co/abuse

Screen content is not recorded, and is not viewed except on the terms set out in the Terms of Service

Compliance

We're building toward industry-standard certifications.

SOC 2

Planned

Planned; independent audit not yet started.

GDPR

Aligned

GDPR-aligned data handling. DPA and EU Standard Contractual Clauses available; hosting in Georgia (EU-adjacent).

ISO 27001

Planned

Planned; certification not yet started.

Responsible Disclosure

Found a vulnerability? Email security@macyou.co with details and we will acknowledge your report.

Macyou will not pursue legal action for research conducted in good faith under this policy. Research is in good faith where you test only against your own deployment, do not access, modify or exfiltrate data belonging to Macyou or any other customer, do not degrade or interrupt the service, do not use social engineering or physical attacks, and give us a reasonable opportunity to remediate before any public disclosure. Research outside these limits is not covered by this policy.

Questions about security?

Our team is happy to discuss security requirements, provide a DPA, or schedule a security review call.