Security

Autonomous, not unsupervised.

Mor proposes. You decide. GDPR aligned, KVKK ready, SOC 2 Type II in progress.

Security & compliance

Mor proposes. You decide. GDPR aligned, KVKK ready, SOC 2 Type II in progress.

Your data stays yours. We do not use it to train public models. Local-first by default — cloud is never required to run Morrow.

Mor proposes; nothing is written to tasks, plans, or integrations until you confirm. Agents inherit the same gate.

You decide who sees what. Role-based access, project isolation, and Google or Microsoft Entra SSO on Business and Enterprise.

TLS 1.3 in transit, AES-256 at rest for cloud components, and the OS keychain for local secrets.

Local-first default

Project data stays on the device. Cloud sync is optional for shared workspaces and Business or Enterprise deploy.

We do not use customer content to train public models. Disconnecting an integration stops new pulls.

With cloud sync: AWS Frankfurt (EU) or Virginia (US). Data residency, air-gap, and customer-managed keys on Enterprise.

DPA for cloud processing, custom DPA on Enterprise, and a Trust page for security and legal review before a demo.