Verified Trust.Enforced Isolation.
Multi-tenancy is not a marketing checkbox—it is a compile-time invariant enforced across every database query and vector index.
MithunAI was engineered from day one to withstand the scrutiny of Fortune 500 Chief Information Security Officers. Explore our architectural perimeter, automated secret stripping, and sovereign deployment guarantees.
Unified high-throughput proxy with semantic caching, dynamic routing & token firewall.
Visual graph orchestration for multi-agent loops, sandboxed tools & human verification.
Read-only context server for Claude Desktop, Cursor, and Windsurf IDEs.
Continuous git repository ingestion with branch patterns and glob filters.
Compile-time OrganizationScope injection guarantees zero cross-tenant leakage.
Parses code trees, Markdown, and technical manuals without tearing scope.
Every answer is constructed strictly from retrieved evidence with source anchors.
Deterministic refusal when evidence is absent, eliminating plausible hallucinations.
Deploy on private AWS, GCP, or on-premises Kubernetes with zero telemetry.
Lightning-fast Server-Sent Events delivering token streams with minimal latency.
Unified high-throughput proxy with semantic caching, dynamic routing & token firewall.
Visual graph orchestration for multi-agent loops, sandboxed tools & human verification.
Read-only context server for Claude Desktop, Cursor, and Windsurf IDEs.
Continuous git repository ingestion with branch patterns and glob filters.
Compile-time OrganizationScope injection guarantees zero cross-tenant leakage.
Parses code trees, Markdown, and technical manuals without tearing scope.
Every answer is constructed strictly from retrieved evidence with source anchors.
Deterministic refusal when evidence is absent, eliminating plausible hallucinations.
Deploy on private AWS, GCP, or on-premises Kubernetes with zero telemetry.
Lightning-fast Server-Sent Events delivering token streams with minimal latency.
Four pillars of enterprise data custody
Every stage of the MithunAI pipeline is wrapped in defense-in-depth controls that fail closed.
Query-Time OrganizationScope Boundary
Tenant scope is not an optional filter—it is an immutable query-time invariant. Every SQL query, pgvector similarity lookup, and cache operation compiles with the authenticated tenant ID. Any request omitting or crossing tenant boundaries fails closed at query construction.
Automated Credential Redaction Scanner
Before documentation chunks or code ASTs are embedded into vector storage, an automated pattern and Shannon entropy scanner strips private keys, AWS tokens, GitHub credentials, and database connection strings, ensuring sensitive secrets are never vectorized.
Prompt Fencing & Injection Defense
Every synthesis prompt is wrapped in cryptographic perimeter fences with per-turn randomized nonces. LLMs are instructed to parse user inputs strictly as passive data, rendering instruction override and prompt injection attacks non-executable.
Sovereign Cloud & Air-Gapped Custody
Run the complete platform inside your private cloud, sovereign AWS/GCP/Azure VPC, or air-gapped on-premises Kubernetes cluster. The architecture emits zero unauthorized outbound telemetry, giving your infosec team full operational custody.
Built for compliance across regulated sectors
Mapped against international security frameworks for enterprise legal and compliance sign-off.
Built to survive a security review
An assistant over your internal documentation is only as safe as the boundary around it. Everything you connect is treated as attacker-controlled input, every decision is recorded, and no organisation can read another one’s corpus.
Retrieval cannot cross an organisation
The corpus an assistant reads is bound to its organisation. Evidence from another tenant’s documents is not something the engine can be asked for.
Ingested content is fenced, not trusted
Retrieved evidence, the question and operator guidance each sit inside a separate fence carrying a per-request nonce. Control characters, bidirectional overrides and invisible Unicode tag characters are stripped before a model ever sees them.
Fetching is bounded by policy, and fails closed
Every outbound fetch to a URL you supply goes through one policy: HTTP and HTTPS only, no embedded credentials, a fixed port set, and a refusal for any host resolving to a private, loopback or link-local address — cloud metadata endpoints included. A host that does not resolve is refused rather than attempted.
Credentials are stripped before indexing
A key committed to a repository or pasted into a document is redacted on the way into the corpus, so it cannot be retrieved back out of an answer.
Denials are recorded as denials
A refused request emits a denial event, kept distinct from an operational failure, and the actor is read from the authorization decision itself — so a request that never gained an organisation context is still audited with a complete actor.
A failed audit fails the request
If the record cannot be written, the operation does not quietly proceed. The guarantee is either kept or the request fails.
Organisations, people and keys
Underneath the assistant is the part that makes it operable by a company rather than by one person: organisations, the people and services in them, what each may do, and what it has been used for.
One organisation, many members
A deployment carries many organisations. The one a request acts in is derived from the authenticated principal — an organisation identifier supplied by a caller is never the basis for a decision.
Signing in grants nothing on its own
Knowing who someone is and deciding what they may do are separate steps, and the second one happens where the action does — never in the interface alone.
Roles carry permissions, requests carry scope
Permissions come from the role held in an organisation, and ownership of the specific resource is checked alongside them — not instead of them.
API keys are principals, not bypasses
A key authenticates as a service principal with its own membership and role. Only a hash is stored, the secret is shown once, and revoking a key takes effect on its next request.
Every caller is a principal, human or not
A person, a service key and a widget visitor are all principals with a type, and whether the actor was human is recorded rather than guessed from a missing user id.
See what it is being used for
Volume and answer-quality counts for your own organisation, broken down by model and by channel, and filterable to a single assistant. Counts only — no shape in the package can carry message content.
What to check before you trust an AI platform
Security review questions, answered as they stand today. Where something is not built yet, this page says so — the roadmap is below, and it is kept separate from what is delivered.
No outbound calls you did not configure
The default posture makes no telemetry or analytics call. Any host the platform talks to is configured and documented.
Secrets are encrypted at rest and never logged
Credentials do not appear in source, tests, fixtures or logs, and log-bound text is sanitised on the way out.
Parameterised queries, enforced by tooling
Query construction is checked by repository tooling rather than left to reviewer attention.
Per-request ceilings and rate limiting
Request volume and per-request cost both have bounds, so one caller cannot consume the deployment.
Not built yet
These are being built and are not part of the platform today. They are listed so an evaluation can plan around what exists now.
Validation against a live provider
No model provider is bundled, and the platform has not yet been run end to end against a live one. Every claim on this page rests on the source and its tests, not on a production deployment.
Agent actions and workflows
Assistants answer today. Agents that plan over several steps, call tools and act in external systems are a later direction, and are not built.
MCP client
The MCP server half is delivered as three read-only tools. Consuming external MCP servers from inside MITHUNAI is deferred.
Per-tenant quota and spend caps
Rate limiting bounds request volume today. Measuring a tenant against a usage or spending budget is not built.
SSO, SCIM and fine-grained RBAC
Enterprise identity integration and finer permission granularity are later milestones.
Boundaries that are enforced, not documented
The platform is built as layered modules with a dependency rule that a linter checks on every change. The foundation layer imports nothing from the layers above it, so the platform core cannot come to depend on the features built on top of it.
The module dependency rule
Each layer may depend only on those listed beside it. The foundation depends on nothing.
experiencedepends onplatform, knowledge, ai, agents, workflowworkflowdepends onplatform, ai, knowledge, agentsagentsdepends onplatform, ai, knowledgeknowledgedepends onplatform, aiaidepends onplatformplatformdepends onnothing
Checked by a linter
The import rule is machine-enforced in continuous integration, not left to review.
Every capability has an API
Each capability is reachable by a client other than our own interface, so the platform is integrable rather than a closed application.
The transport holds no logic
The HTTP layer parses, calls the module that owns the capability, and serialises. There is no behaviour in it that a reviewer would have to find twice.
Deployable where your data has to live
The platform runs as a containerised deployment, so it can be operated in an environment you control rather than only as a hosted service.
Technical questions, answered directly.
Everything an enterprise architect or security officer needs to verify before deploying MithunAI.
Connect your documentation. Give your customers and teams answers they can check.
MITHUNAI is in active development toward its first release. If you are evaluating how your organisation will answer questions from its own knowledge, we would like to hear what you need.