Built to be evaluated.

BYOK means we hold the most sensitive thing you can give us: credentials to your provider accounts. They are treated accordingly. You choose which providers to connect and how many run in a mixture — a key you never add is a key we never hold.

• Provider keys are encrypted at rest with envelope encryption — a unique data key per secret, wrapped by a master key that lives in a separate key-management service.
• Keys are decrypted only in memory, at call time, in the process making the provider request. Plaintext keys are never written to disk.
• Keys never appear in logs, traces, or error reports. Trace records reference providers by alias, not by credential.
• You can delete a key at any time from the dashboard or API. Deletion revokes it from the orchestrator immediately.
• This describes keys you add to your account. Keys entered in the Build workspace's "your keys" mode never reach our storage at all — they stay in your browser and pass through a stateless proxy that forwards each request and stores nothing.

Run traces — the drafts, critiques, and judge decisions behind each answer — are stored so you can replay and audit runs. You control how long.

• Retention is configurable per project, from the default window down to zero-retention mode (Scale plans and above), where traces are discarded as soon as the response is delivered.
• Moamao Cloud runs are used to train and improve our own models — you're included by default and can opt out anytime (see the privacy policy). BYOK runs never are, and we never train anyone else's models on your content.
• Traces are encrypted at rest and scoped to your account.

A mixture pipeline moves model output between models, which is exactly where injection attacks live — and exactly where propose, critique, aggregate pays off. No layer's output is trusted outright; the orchestrator is built around that assumption.

• The aggregator treats proposer drafts as untrusted content, not as instructions. Drafts are delimited and passed as data; a draft that says "ignore previous instructions" is judged, not obeyed.
• System prompts and tool access are isolated between layers. Proposers cannot see or alter the judge's instructions, and no layer inherits another layer's tool permissions.
• This layering follows OWASP guidance for LLM and agentic applications: treat all model-generated text crossing a trust boundary as attacker-controllable input.

Nothing sits between your request and the model providers you chose except the orchestrator itself.

• All traffic requires TLS 1.2 or higher, in and out.
• Provider calls go direct from our orchestrator to the provider — no intermediary proxies or resellers in the path.
• No third-party analytics or tracking runs on API paths. What your application sends to the API is seen by the orchestrator and your chosen providers, nothing else.