Security & trust

    You hand us the keys. Here’s how we treat them.

    Agencies trust MaintainHQ with client sites. This page closes the deal: access model, credentials, residency, and guardrails for autonomous AI.

    How Gus accesses sites

    A lightweight WordPress connector plugin authenticates with site-scoped credentials. Gus never needs your hosting panel password. You can revoke access instantly by disconnecting the plugin.

    Credential handling

    API keys and tokens are stored encrypted at rest. Secrets are not logged in chat transcripts or client-facing reports. Rotate keys anytime from the dashboard.

    Data residency

    Application data is hosted on Supabase infrastructure with industry-standard encryption in transit (TLS). Ask us about residency preferences for Agency accounts.

    Audit everything

    Every diagnosis, command, and fix is logged. Export trails for clients, compliance, or post-mortems. No silent autonomous changes.

    Guardrails by default

    Approval modes (observe / ask-first / auto), staging-first deploys, and automatic rollback. Autonomous AI without a safety story does not close agency deals in 2026.

    Frequently asked questions