Your evidence stays under your control.
Mobasi runs on hardware or cloud accounts you control. It doesn't keep your prompts or results, and every action it takes is logged.
Built to hold up to scrutiny.
Investigations face audits, subpoenas, and attackers. Four principles shape how we build and run Mobasi.
- 01Your data stays putMobasi reads evidence and logs where they already live. Nothing moves into a store we control.
- 02No data retentionPrompts and responses exist in memory only while a request runs. Model providers don't keep them or train on them.
- 03Results you can checkEvery action is logged, and results are files your team can open, rerun, and verify.
- 04Audited controlsSOC 2 Type II. Branch protection, gated releases, and vulnerability management are part of how we ship.
Runs in your environment.
Mobasi runs on hardware or cloud accounts you control. Nothing sits in the middle holding your data.
It calls approved model providers for analysis and writes its results back to your environment, where your team owns them.
Zero data retention.
Prompts and responses pass through memory and are discarded when the request ends.
We don't write them to a database or log their contents. Our model providers don't keep them or train on them.
Mobasi staff can't see your investigations, and an attacker who breached our systems would find nothing to take.
Zero-retention providers
Anthropic
OpenAI
Google Gemini
AWS
Azure
Evidence stays in place.
Disk images, mailboxes, extractions, and logs stay on systems you control.
When Mobasi needs a specific record, like an email header or a file path, only that excerpt goes to the model. It isn't stored.
Every step is on the record.
Each run logs what Mobasi read, which tools it ran, and what it concluded.
Results are written as files: reports, transcripts, notes on method, and the commands behind them. Another examiner can rerun the work and check the result.
FAQs for security teams.
Does our data leave our environment?
Evidence and logs stay where they are. When Mobasi needs a specific record, only that excerpt goes to the model provider, and it isn't stored.
Do you retain investigation data?
No. Prompts and responses aren't written to a database or logged, and they aren't used for training.
Can we see exactly what Mobasi did?
Yes. Every action is logged and every result is a file, so a reviewer, opposing counsel, or another examiner can trace how each finding was made.
How do you support defensibility?
Each result records the commands, inputs, and method behind it, so the work can be rerun and checked without Mobasi.
Do you keep a central evidence database?
No. Evidence stays in your environment, and Mobasi connects to model providers directly from there.
How do you handle AI risks like prompt injection?
We design for prompt injection, tool extraction, and credential exposure, and treat them as ongoing work, not solved problems. We cover the details under NDA.
Are you SOC 2 compliant?
Yes. Our SOC 2 Type II report is available upon request.
Can Mobasi run on our own infrastructure?
Yes. Mobasi runs on hardware or cloud accounts you control. Email security@mobasi.ai and we will walk you through the setup.