Security — MokingBird AI

MokingBird Oy | Business ID: 3615646-1 | Finland

Last updated: April 2026

Security Overview

MokingBird AI products are built on a local-first architecture — meaning the primary security model is architectural rather than perimeter-based. By running AI operations entirely on your device, we eliminate the largest attack surface present in cloud AI systems: a central server holding your data.

This document explains our security approach across all MokingBird AI products (Node, mbRAG, mbDataGen, mbFT), what data is protected, how, and how to report security issues.

1. Local-First Architecture

The most significant security property of MokingBird AI is that we have no servers holding your data.

In cloud AI systems, your documents, queries, and model outputs are transmitted to and stored on provider servers. This creates:

• A central target for attackers (your data + millions of others)
• Insider threat risk at the provider
• Regulatory exposure from cross-border data transfers
• Supply chain risk if the provider is compromised

With MokingBird AI, your documents stay on your machine. Your vector stores are local. Your model checkpoints are local. Your datasets are local. There is no MokingBird server that, if breached, would expose your data — because we don't have your data.

This is not a claim about perfect security. It is a statement about threat model: the primary threats are local (your device's security) rather than remote (a provider's server breach).

2. API Key Security

When you connect MokingBird AI tools to external LLM or embedding providers, you provide API keys. These keys:

• Are stored in a local configuration file on your device (or the OS keychain if supported by your platform)
• Are encrypted at rest using platform-standard encryption where available
• Are transmitted only to the third-party provider when making API calls — not to MokingBird servers
• Are never logged in plain text by the application

Best practices for API key security:

• Use provider-specific API keys rather than organization master keys
• Set spending limits on your API keys at the provider's dashboard
• Rotate keys periodically or after sharing with others
• Do not put API keys in documents you feed into the system

3. Document and Data Security

Files you process through mbRAG, mbDataGen, or mbFT are processed in memory on your machine and, where persistence is needed, written to local disk.

Local file storage:

• Vector stores (ChromaDB, FAISS, local Qdrant) are stored in directories you configure
• Generated datasets from mbDataGen are written to output paths you specify
• Fine-tuned model checkpoints from mbFT are written to local directories
• None of these are uploaded or synced by MokingBird

Recommendations:

• Store sensitive vector stores and datasets in encrypted directories or drives (e.g., BitLocker on Windows, FileVault on macOS)
• Apply appropriate filesystem permissions to restrict access on shared machines
• Follow your organization's data handling policies for sensitive documents

4. Network Security

MokingBird AI applications make network requests in the following controlled circumstances only:

All API calls to third-party providers use HTTPS. We enforce TLS for all outbound connections.

When using local LLMs (Ollama, llama.cpp, local HuggingFace models), zero network requests are made for inference. The application is entirely air-gapped from an LLM perspective.

5. Application Security

MokingBird AI desktop applications are built using PySide6 (Python) and follow application security best practices:

• Dependency management: Dependencies are pinned and audited for known CVEs before each release
• Input validation: Document parsers validate file types and content before processing to prevent parser-based attacks (e.g., malicious PDF or ZIP bombs)
• Process isolation: Each module (RAG, DataGen, FT) runs in its own process context where possible
• No remote code execution: The local FastAPI endpoints exposed by the Node are bound to localhost (127.0.0.1) by default and are not accessible from the network without explicit user configuration
• Secure defaults: No services are exposed to the network by default

Local API security: The FastAPI endpoints exposed for programmatic access listen on localhost only. If you expose them to a network interface for integration purposes, you are responsible for securing that endpoint (authentication, firewall rules, VPN).

6. Model Security

When downloading models (e.g., from Hugging Face) for use with mbFT or local inference:

• MokingBird does not curate or host model files directly — you download from the model provider's official repository
• We recommend only downloading models from verified, reputable sources (official Hugging Face model cards, research paper repositories)
• Be aware that model files (particularly .safetensors, .gguf) from unverified sources may contain malicious payloads — apply the same scrutiny you would to any executable

MokingBird Oy is not responsible for security issues arising from third-party model files you download and use with our tools.

7. User-Side Security Responsibilities

Because MokingBird AI runs locally on user-controlled hardware, users are responsible for:

• Keeping the host OS and endpoint protection up to date
• Applying disk encryption and maintaining secure backups of local data, vector stores, and model outputs
• Applying network segmentation where required by organizational policy
• Managing access controls on local machines and shared internal networks
• Using dedicated, scoped API keys rather than organization master keys
• Reviewing third-party provider terms and data residency settings when using cloud LLMs

8. Secure Operations Practices

Recommended practices for teams deploying MokingBird AI:

• Keep software versions current — security patches are included in regular updates
• Enforce least-privilege access on machines where the tools are installed
• Maintain audit trails for sensitive workflows where policy requires
• Use separate environments for testing/experimentation and production workloads
• Rotate API keys periodically and immediately if exposure is suspected

9. Reporting Security Issues

We take security vulnerabilities seriously and respond promptly.

To report a security vulnerability:

1. Email [email protected]
2. Include a description of the vulnerability, steps to reproduce, and potential impact
3. If possible, include a proof-of-concept (without deploying it against systems you don't own)
4. We will acknowledge receipt within 48 hours
5. We aim to provide an initial assessment within 7 days and a fix timeline within 14 days for critical issues

Please do not:

• Publicly disclose vulnerabilities before we have had a chance to fix them (responsible disclosure)
• Test against systems other than your own installations
• Use the vulnerability for any purpose other than demonstrating the issue

We are working toward a formal bug bounty program. Until that is live, we appreciate responsible disclosure and will acknowledge contributors publicly (with their permission) in release notes.

10. Security Updates

MokingBird Oy releases security patches as part of our regular update cycle. For critical security vulnerabilities, we release out-of-band patches as quickly as possible.

We strongly recommend:

• Enabling automatic update checks in the application settings
• Following @mokingbirdxyz for security announcements
• Subscribing to our newsletter for important updates

Security advisories are published in our GitHub repository release notes.

11. Forward Security Roadmap

Planned security maturity improvements include:

• Expanded threat-model documentation per deployment mode (local-only, hybrid, multi-user)
• Hardening guides for enterprise deployments
• More explicit enterprise security controls and configuration checklists
• Formal security audit cycle

This is a first-version security overview. It will be refined with formal security review cycles.

Contact

• Security issues: [email protected]
• AI product support: [email protected]
• General: [email protected]

MokingBird Oy Business ID: 3615646-1 Finland