# Security

> MARFI Insight AI uses tenant isolation, encryption at rest, TLS in transit, plan gates, and scoped capture controls for workplace telemetry.

Canonical URL: https://insight.marfi.app/security

Work telemetry is sensitive operational data. MARFI's security posture focuses on tenant separation, encrypted storage, scoped access, plan gates, retention enforcement, and clear capture boundaries.

## Audience

Security reviewers, IT leaders, and enterprise buyers.

## Search Intent

Review MARFI security controls for workforce telemetry and AI training data.

## Every tenant is treated as a boundary.

Tenant isolation keeps one organization's devices, events, screenshots, metrics, billing, and profiles separate from another. Administrative views and acting-tenant controls are guarded by role checks.

## Sensitive data is encrypted in storage and protected in transit.

MARFI uses TLS in transit and encrypted storage for retained data. Tenant LLM keys are encrypted at rest and decrypted only in memory per request.

## Plan and consent gates are security controls too.

Insight workspaces cannot accept screenshot data. Trajectory unlocks richer capture, but the user still controls capture tiers. Retention windows age out data by tenant and plan.

## FAQ

### How are tenant LLM keys handled?

Tenant-supplied LLM keys are encrypted at rest and decrypted only in memory per request. MARFI adds no token fee.

### Does MARFI isolate tenant data?

Yes. The platform is designed around tenant isolation and scoped access to prevent cross-tenant data exposure.

## Related Pages

- [Privacy](https://insight.marfi.app/privacy): MARFI's privacy model uses consent tiers, telemetry-only Insight capture, customer data ownership, and retention windows.
- [Data Ownership](https://insight.marfi.app/data-ownership): MARFI customers own their raw work captures and every derived trajectory. MARFI takes no license and does not train models on customer data.
- [Retention](https://insight.marfi.app/retention): MARFI Insight AI retention is plan-based: 90 days rolling on Insight and 12 months on Trajectory, with automated deletion of expired data.
- [Self-Hosted Enclave](https://insight.marfi.app/self-hosted-enclave): MARFI Enclave is the self-hosted deployment option for organizations that need workforce telemetry and AI training data inside their own infrastructure.