Trust
This page describes what the platform does now. Where something is being added, it says so. The detail behind each section is in the product documentation.
Mojo Up AI Cloud and the Enterprise organisation Mojo Up hosts run in Microsoft Azure, in the australiaeast region. The database, the object storage for encrypted backups, the caches and the logs are all there. Remote control of your workbenches goes through a relay that carries only encrypted packets between your machines; it cannot read them, and your work between machines is not stored by Mojo Up.
Every record carries the organisation it belongs to, and every query is asked for one organisation. Beneath that, the database enforces it again with row-level security on every table that holds an organisation's data. Inside your organisation, people see what their role allows. Mojo Up staff operate the service and do not read your organisation's contents in the course of normal operation; logged, reasoned staff access is being added and is not described as in place until it is released.
The platform does not call your AI providers. Your workbenches and nodes call them from your machines with your own keys. Mojo Up does not see prompts or replies unless your workbench sends usage records to the platform, which carry what you have configured them to carry: models, counts, costs and the like.
Every connection is over TLS with managed certificates. Azure encrypts the database, disks and storage at rest. On top of that, credentials the platform holds for you are sealed with AES-GCM under a key in Azure Key Vault, bound to your organisation and to the record. Tokens issued to devices are stored as SHA-256 hashes only. Workbench backups are encrypted on the machine before upload; Mojo Up stores your ciphertext and never holds the key.
The database is backed up continuously by Azure with point-in-time restore: 14 days of restore points today, 35 on the high-availability profile Mojo Up AI Cloud is moving to. A restore drill is documented and rehearsed. One organisation can be restored on its own from its export without touching others.
Every approval, enrolment, dispatch, task hand-off and policy change is written to an append-only, hash-chained audit log that names the person, agent and compute involved. Search and export the chain from the console, verify it has not been changed, or forward it to your SIEM.
Enterprise runs the same images in your own tenancy or on-premises, from Bicep, Helm or docker compose. The first customers run it to an ISM PROTECTED baseline, and the roadmap's first item maps each applicable control to the code or configuration that implements it, with a generated SSP annex and POA&M.
We would rather answer them before you buy than after. The Canberra team has done this with federal agencies and regulated industry.