How is my data and IP protected, and do you train AI on it?

You own what you put into Mochlion and the Build Specifications it produces. We don't use your content to train AI models, and the AI providers we use are contractually barred from doing so. Each customer's project data is walled off in the database, sign-in is by an emailed one-time link or code, and backups are encrypted and kept off-site.

Here are the details, and the limits.

Who owns the specification?

You do. Section 6.1 of our Terms of Service says that, between you and us, you own your content and your Build Specifications and everything in them. You can hand the specification to any developer, and you can export your projects at any time.

We own the platform itself: the software, its question logic, prompts and templates. Using it doesn't give us rights to your content beyond what's needed to run the service for you.

Do you train AI on my data?

No. Section 6.6 of the Terms says: "We do not use Customer Content to train AI models, and our AI providers are contractually barred from doing so." The AI providers process your content only to return results to us, and we use providers based in the United States or allied nations only. The Privacy Policy lists each provider and what it does.

If an expert answers by voice, the audio is converted to text and discarded. Only the text they submit is kept.

How is my data kept separate from other customers'?

Each project's data is isolated in the database with row-level security, so one customer's account can't reach another's. An automated test tries to read across that boundary and must find nothing, and it runs on every release. Our staff manage accounts and billing but don't browse project content.

How do people sign in?

By a one-time link or a 6-digit code sent to their email. There are no passwords to reuse or leak. Repeated failed sign-ins are limited, and API tokens are shown once, stored only as a one-way hash, and can be revoked at any time.

What protects the service itself?

Data is encrypted in transit. Cloudflare sits in front of the service for network security. Backups are encrypted before they leave our servers and kept off-site, and restoring from them is tested.

What happens if I ask you to delete my data?

Ask in writing and we delete your account or project content within 30 days. Copies in backups are overwritten on their normal cycle, currently 30 days. We keep billing and tax records the law requires, and anonymous, pooled counts that can't identify you, your client, any person or any project, such as how many questions a typical project needs.

Is it certified or set up for regulated data?

Mochlion doesn't hold security or compliance certifications, and it isn't set up for health records or payment card data. Please don't upload health records, card or bank numbers, government ID numbers or passwords. Payments are handled by Stripe; we don't receive full card or bank numbers.

No system is perfectly secure. If a breach affects your personal information, we'll notify you as the law requires.

Who can see what inside a project?

You decide who's invited and what they see. Experts answer their own questions privately, and names appear only to the people allowed to see who said what.