Security

Autonomous, not unsupervised.

Mor proposes. You decide. GDPR aligned, KVKK ready, SOC 2 Type II in progress.

Security & compliance

Mor proposes. You decide. Every control below applies to Morrow and every agent in your workspace.

GDPR alignedKVKK readySOC 2 Type II in progress

Zero data retention

Your data stays yours. We do not use it to train public models. Local-first by default — cloud is never required to run Morrow.

You approve every action

Mor proposes; nothing is written to tasks, plans, or integrations until you confirm. Agents inherit the same gate.

Access control & SSO

Role-based access, project isolation, and Google or Microsoft Entra SSO on Business and Enterprise.

Encryption end to end

TLS 1.3 in transit, AES-256 at rest for cloud components, and the OS keychain for local secrets.

Local-first default

Project data stays on the device. Cloud sync is optional for shared workspaces and Business or Enterprise deploy.

We do not use customer content to train public models. Disconnecting an integration stops new pulls.

With cloud sync: AWS Frankfurt (EU) or Virginia (US). Data residency, air-gap, and customer-managed keys on Enterprise.

DPA for cloud processing, custom DPA on Enterprise, and a Trust page for security and legal review before a demo.