Security

Your research is valuable, and much of it is unpublished. This page explains how Multilo protects your work, what you control, and how to use AI agents safely. For what data Multilo collects and keeps, see data usage.

How Multilo approaches security

Local-first foundation

Your projects are ordinary folders on your computer. The editor, your library, search, history, and memory all run locally, so you can open, write, and search without anything leaving your device. Multilo uses the internet for your account, for updates and add-ons, and to send an AI model the part of your work that a request needs. See privacy & data.

You stay in control of agents

Agents can read your project, edit your document, and run code, but they work where you can see them:

• Edits happen in front of you. You can watch an agent work and stop it at any point.
• Suggestions wait for you. Inline suggestions change nothing until you accept them.
• Agents ask when they need a decision instead of guessing, and when chat hands a job to an agent it confirms the project first.
• Code runs in a sandbox. When an agent runs code, it runs in an isolated environment with limits, and heavier work asks your permission first.
• Spending has a ceiling. A per-task token budget in Settings → AI pauses a long run and asks before it spends more.

Built-in protections

• Projects are kept apart. One project’s files, library, and project memory never reach another.
• Changes can be undone. Inside a project, the last 40 versions of each document are kept for 14 days, and deleted files go to a project trash. See versions & safety.
• No invented citations. With strict integrity mode on, the AI refuses to make up a citation, and Claim Check checks each citation against its real source.

You are still responsible for what you publish or submit: read what an agent wrote, and check its sources, before your name goes on it.

Work safely with untrusted content

Agents read text from many places — PDFs in your library, web pages found while searching for sources, documents other people send you. Text like that can contain hidden or misleading instructions written to steer an AI (this is called prompt injection). The protections above limit what such text can do: the agent works where you can see it, code stays in the sandbox, and heavier work needs your permission. Add your own good habits:

1. Read what an agent changed before you rely on it.
2. Be careful with documents and web pages you don’t trust, and don’t ask an agent to follow instructions found inside them.
3. Check changes to your most important files closely.
4. Verify every citation with Claim Check or by reading the source yourself.
5. If an agent does something unexpected, stop it and tell us.

Extensions and skills

Extensions and skills add new abilities to Multilo, so they are built to be contained:

• Sandboxed: extensions run in an isolated runtime and reach the app only through a permissioned API.
• Declared permissions: each extension lists what it needs, and you see those permissions before it runs.
• Trust tiers: marketplace items are marked first-party, verified publisher, or community, so you know who stands behind them.
• Reviewed and signed: marketplace submissions are checked automatically for policy problems and leaked secrets, and approved packs are signed.

Prefer first-party and verified-publisher items, and read the permissions before you install. See installing extensions.

The desktop app

Multilo’s installers are code-signed by INTUTO4U LLC, and the macOS app is notarized by Apple. Each download is published with its SHA-256 checksum, so you can confirm the file is complete and unchanged. Download Multilo only from multilo.com/download — repackaged copies from other sites can be damaged or tampered with. See verify your download.

Your account

• Passwords are stored only as secure hashes, never as plain text.
• The desktop app gets its own signed, time-limited sign-in — never your password.
• Repeated failed sign-ins are slowed down, and Multilo emails you about repeated failures, sign-ins from a new country, and password changes.
• Settings → Security on multilo.com lists where you’re signed in and can sign out every device at once.

See authentication for the details.

On our servers

• Encrypted connections: the website and every request from the app use HTTPS, and browsers are told to always use it.
• Hardened website: pages are served with a strict content security policy and other protective headers.
• Signed tokens: sign-ins are cryptographically signed and expire.
• Encrypted GitHub access: if you connect GitHub, its access token is stored encrypted.
• Rate limits: sign-in, sign-up, and password reset are rate-limited to slow down abuse.

Security best practices

• Keep Multilo up to date, so you have the latest fixes.
• Use a strong, unique password, and keep your email account secure.
• Treat connection keys and CLI tokens like passwords, and never share them.
• Install extensions and skills you trust, and review their permissions.
• Keep sensitive work inside a Multilo project, so history and trash protect it, and back up milestones with Git.
• Check Where you’re signed in now and then, and sign out devices you no longer use.

Reporting security issues

If you find a security problem in Multilo:

1. Don’t share it publicly.
2. Report it through the support page and choose Report abuse (“Report a security issue or policy violation”).
3. Include clear steps to reproduce it.
4. Give us time to fix it before anything is made public.

Related resources