Exact about security.

Everything on this page is a control that exists today — no aspirational badges. If your review needs more depth than this page, ask us and a human will answer.

TLS everywhere
OIDC + PKCE sign-in
Per-tenant rate limits
Monthly spend caps
Stripe payments — no card data on Muso
Instant key rotation
Nightly end-to-end tests

API keys

•Two key types with different trust levels: secret keys (msk_) authenticate servers and are shown once at creation; publishable keys (mpk_) are browser-safe, strictly read-only, limited to the embed surface, and registered to your domains.
•Rotate or revoke any key instantly from the console — enforcement happens at the gateway on the next request, with no deploy or support ticket.
•Removing a team member automatically rotates the workspace key they had access to.
•A publishable key can never reach the paid catalog API, analytics, or any write operation — the gateway rejects it outside the embed read surface.

Accounts & sign-in

•One Muso identity for every app, served by our own identity service at login.muso.ai — OpenID Connect with PKCE, verified id tokens, and single logout.
•Google, Apple, and Facebook sign-in are supported; email sign-ups require verification.
•Workspace roles (owner / admin / member) are enforced server-side: key material and billing actions are role-gated at the API, not just hidden in the UI.

Abuse & rate protection

•Every key carries per-tenant rate limits enforced cluster-wide at the gateway, and every account has a monthly spend cap by usage tier — a runaway integration stops at its ceiling instead of running an unbounded bill.
•Usage above the catalog-scale threshold is refused outright (403) rather than billed — bulk extraction is not purchasable.
•Every response is attributable to the key that requested it.

Data licensing controls

•Standard plans are licensed for live, in-app use: no caching, storing, reselling, or redistributing licensed data — the contract, the docs, and the product all state the same rule.
•Enterprise agreements can include a term-limited storage license with certified deletion at termination.
•The full terms are public: Terms of Service and the Data License Agreement.

Infrastructure

•TLS everywhere; the platform fronts through a global edge network with WAF and bot mitigation.
•The identity store runs isolated from analytics and catalog systems, on replicated storage with nightly offsite backups.
•Payments are processed by Stripe — card numbers never touch Muso systems.
•The full public surface is exercised nightly by an end-to-end test suite (sign-up, checkout, keys, API calls, sign-out) with alerting on regression.

Report a vulnerability

Found a security issue in platform.muso.ai or the API? Email legal@muso.ai with steps to reproduce. Report in good faith and give us a reasonable window to remediate before any public disclosure, and we won't pursue action for testing that respects that boundary. Our machine-readable contact lives at /.well-known/security.txt (RFC 9116).

Security questionnaire, vendor review, or a question this page doesn't answer? Send it over — we respond with specifics, not marketing.