Trust & data processing

Operator: Five S LLC · Last updated 3 November 2026

This page states MultiO’s security posture as it actually is today, and carries our standard Data Processing Addendum (DPA) for Teams and organisation customers. We would rather tell you plainly what is and is not in place than dress it up: where a capability is not available yet, this page says so.

Security posture — what is in place today

• Encryption in transit. MultiO is served over HTTPS only; the site redirects plain HTTP to HTTPS and browsers are instructed to keep it that way. Data between your browser, our servers and the model providers travels over encrypted connections.
• Passwords and sign-in. Passwords are stored only as salted hashes — never in plain text, and never recoverable by us. You can also sign in with Google or Apple. Accounts can be protected with passkeys and with TOTP two-factor authentication (authenticator apps), both available in Settings. Access to accounts is token-based, sign-in attempts are rate-limited, and our signup form is protected by Cloudflare Turnstile abuse prevention.
• Your own provider keys (BYOK) and developer API keys. Provider keys you add are envelope-encrypted at rest and used only to make the calls you direct. MultiO developer API keys are stored as SHA-256 hashes only — the key itself is shown once, at creation, and cannot be read back.
• Where data lives. The application and its data store run on Fly.io infrastructure in San Jose, California, USA. We do not operate other regions today. The AI providers who answer you process prompts under their commercial API data policies, as described in Sections 2–3 of the Privacy Policy.
• What we never do. We never sell personal data, we do not train models on your content, we run no cross-site advertising tracking, and we set no third-party cookies. Live voice is never recorded, stored or transcribed (Privacy Policy, Section 4B).
• Your controls. Every user can export everything (Settings, one JSON file), delete individual conversations, uploads, memory facts and share links, revoke API keys and share links, and delete their account in-product. Account deletion cancels any subscription and deletes the Stripe customer first, then purges the user’s content and replaces the account record with an anonymized tombstone, as described in Privacy Policy Section 7. Retention periods per data category are stated in Privacy Policy Section 8.
• For organisations. Organisation admins see member email addresses, organisation-key usage totals and an audit log of organisation events — never members’ personal conversations, personal chats, personal API usage or any content (Privacy Policy, Section 4F).
• Incidents. If we learn of a breach affecting your data, we will tell you as the law requires. Organisation customers with an executed DPA get the notification commitment in clause 7 of the DPA below.
• Not yet — stated honestly. Single sign-on, directory sync and independent security certifications are on our roadmap; they are not available today and nothing on this page should be read as claiming them. If your procurement process requires them, talk to us before purchasing: hello@multio.ai.

Sub-processors (the service providers who process data on our behalf) are listed in Privacy Policy Section 6A and in clause 6 of the DPA below. Security questions: support@multio.ai.

Data Processing Addendum (DPA)

This Addendum is between Five S LLC, 5777 Foligno Way, San Jose, CA 95138, USA (“MultiO”, the Processor) and the organisation customer identified in the execution block below (the “Customer”, the Controller). It applies to MultiO’s processing of Organisation Data under a Teams or organisation plan, supplements the Terms of Service, and is written to satisfy Article 28 of the EU and UK GDPR. In the event of a conflict between this Addendum and the Terms, this Addendum controls for Organisation Data.

1. Subject matter, duration, nature and purpose

MultiO provides a hosted service that routes prompts to third-party AI model providers and returns their answers, with shared billing, organisation API keys and usage governance. As Processor, MultiO processes Organisation Data only to provide that service to the Customer’s organisation. This Addendum lasts for as long as the Customer holds a Teams or organisation plan, plus the deletion period in clause 9.

2. Definitions and scope

“Organisation Data” means the personal data MultiO processes on the Customer’s behalf in the organisation context: organisation member account identifiers (including email addresses), organisation membership and role records, per-member organisation usage totals, organisation API-key metadata and usage, and the organisation audit log. Organisation Data does not include a member’s personal conversations, personal chats, personal API usage or content: members’ personal accounts are governed by the Privacy Policy, under which MultiO is the controller, and are never visible to organisation admins. “Personal data”, “processing”, “controller” and “processor” carry their GDPR meanings.

3. Documented instructions

MultiO processes Organisation Data only on the Customer’s documented instructions — which include this Addendum, the Terms and the Customer’s use of the service’s organisation controls — unless the law requires otherwise, in which case MultiO will inform the Customer before processing, unless the law prohibits it.

4. Confidentiality

MultiO ensures that the people authorised to process Organisation Data are bound by confidentiality and access it only as needed to operate and support the service.

5. Security measures

MultiO implements the technical and organisational measures summarised in the security posture section above: encryption of data in transit (HTTPS only), salted password hashing, token-based access, passkey and TOTP options, rate-limited sign-in and abuse prevention, envelope encryption of customer-supplied provider keys, hashed storage of developer API keys, and the organisation visibility boundaries described in Privacy Policy Section 4F.

6. Sub-processors

The Customer authorises MultiO to use the following sub-processors for Organisation Data. This list is the same list maintained in Privacy Policy Section 6A:

MultiO will update this list and Privacy Policy Section 6A before a new sub-processor starts processing Organisation Data, and will email the organisation owner of record before the change takes effect. If the Customer objects on reasonable data-protection grounds within 14 days of that email, the parties will discuss in good faith; if they cannot resolve the objection, the Customer may terminate its organisation plan for a pro-rata refund of prepaid fees.

7. Assistance and personal-data breaches

MultiO will assist the Customer, taking into account the nature of the processing, in meeting its obligations to respond to data-subject requests (access, erasure, rectification, portability, restriction and objection). The self-serve tools — full account export, in-product deletion, per-member usage views — are available to the Customer and its members at no extra charge; further reasonable assistance will be provided without undue delay. MultiO will notify the Customer without undue delay, and in any case within 72 hours after becoming aware of a personal-data breach affecting Organisation Data, with the information Article 33(3) requires, as it becomes available.

8. International transfers

MultiO stores and processes Organisation Data in the United States (see “Where data lives” in the security posture above). Where Chapter V of the GDPR or UK GDPR requires transfer safeguards, the parties rely on the standard contractual clauses (and the UK Addendum / IDTA, as applicable) incorporated in the relevant providers’ data-processing terms, as described in Privacy Policy Section 8.

9. Return and deletion

When the Customer’s organisation plan ends or the organisation is deleted, MultiO deletes the organisation’s records — membership rows, organisation keys and the organisation audit log — under the mechanics described in Privacy Policy Sections 7 and 8. Members’ personal accounts are unaffected: they are personal accounts, not Organisation Data. Billing-ledger entries are retained against the anonymized account identifier for tax, audit and chargeback records, as the Privacy Policy states.

10. Audit

MultiO will make available the information reasonably necessary to demonstrate compliance with this Addendum — this page and the Privacy Policy are the standing documentation — and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, on reasonable notice, no more than once per year (plus after a breach affecting Organisation Data), during business hours, and without access to other customers’ data or to systems unrelated to Organisation Data.

11. Execution

How to execute this DPA. An authorised signatory for the Customer completes the block below and emails a countersigned copy of this page (printed or PDF) to legal@multio.ai; alternatively, an email from an authorised signatory to legal@multio.ai stating “We accept the MultiO Data Processing Addendum published at multio.ai/trust, as of [date]”, and identifying the organisation and its MultiO organisation account, is equally effective. MultiO will countersign and return a copy for the Customer’s records. The Addendum is effective on the date of the Customer’s signature or accepting email.

Agreed for Five S LLC: the countersignature is returned with the copy sent back to the Customer.