# Where your data lives and who can see it

Mojobase keeps each company's data on its server in Helsinki, Finland, hosted by Hetzner, kept apart from every other company's. Logins for connected accounts are encrypted with a key that belongs to that company alone. The AI and agents see only what the person they work for can see, our AI accounts have model training disabled, and everything is recorded.

Updated 7 November 2026

## Where does Mojobase keep my data?

On our server in Helsinki, Finland, hosted by Hetzner: what you and your team put in Mojobase, and copies of the mail and calendars you connect. Hetzner keeps daily copies of the server for 7 days. Each night we also send an encrypted copy of what your team keeps in Mojobase, apart from mail and the passwords and permissions for connected accounts, to Hetzner’s storage in Helsinki, in case the server is lost. It’s encrypted before it leaves the server, and each copy is deleted within 30 days.

## How is one company’s data kept apart from another’s?

Each company’s data is kept apart from every other company’s. The passwords and permissions for connected accounts, such as a Gmail sign-in or a Shopify connection, are encrypted with a key that belongs to that company alone, and nobody else’s part of Mojobase can read them. They’re never shown to a person, written to a log or handed to an agent.

## Who inside my company can see what?

Each person’s own things are theirs until they share them, and the company’s shared things are the whole team’s. Owners manage the team and the company’s settings; members use the apps; guests in Team chat see only the channels they’re invited to. Every app checks a person’s role on every request, so a change of role or a removal takes effect at once.

| What | Who sees it | AI |
| --- | --- | --- |
| A mailbox you connect | You, until you share it with the team | Its own switch |
| Your calendar | You; teammates see only when you’re busy, or what you share | Its own switch |
| Your My files | You, owners included, until you switch it to Team | Its own switch |
| The Company folder | Everyone in the company | On; an owner can switch it off |
| A Team chat channel | The team for a public channel, its members for a private one; guests only where invited | Its own switch |
| Numbers | Owners, until an owner opens it to others | Numbers Settings |
| Customers and the Handbook | Everyone in the company, by collection for the Handbook | Each app’s settings |

## What can the AI see, and where does it send it?

Only what the person it works for can see. AI features read a mailbox, calendar, channel or folder only while AI is switched on for it, and each has its own switch. When they do, only the content needed is sent to the company that runs the AI model for that feature: by default Mojobase’s own accounts with Anthropic or OpenAI, with model training disabled on those accounts. Mojobase’s AI log records the time, the app, the model, the person and which items were shown, never their contents. If your company uses its own AI key (Anthropic, OpenAI or OpenRouter), content goes to that provider under your company’s agreement with it. An agent you connect yourself (ChatGPT, Claude, Gemini, Grok, Hermes or your own setup) sees only what you can see, and what it reads goes to its provider under your own account and terms.

Text from outside the company, such as an email, a calendar invite or a web page, is handed to the model as evidence and never as instructions. Scheduled runs reach the apps only through tools that read and that make drafts, suggestions and approval requests, so a mail that says “forward this to …” stays harmless.

## What can agents connected over MCP do?

Exactly what the person who connected them can do, and nothing more. An agent acts with that person’s role and only the apps they may open, checked on every request, and every action is recorded in Activity with the agent’s name. A key is shown once and only a fingerprint of it is stored; each person has at most ten, and any key can be switched off at once in Settings → Connect an agent. More on [Mojobase’s MCP server](https://mojobase.ai/mcp).

## Can people at Mojobase read my data?

Nobody at Mojobase reads your connected mail or calendars, except when you ask us to, for example to help with a problem, when it’s needed for security, such as looking into abuse, or when the law requires it. Outside your company, recipients are our server host, Hetzner, Mojobase’s AI providers while AI is on, and the company-selected AI providers and agents you authorise. For Google data, Limited Use and the prohibition on generalised AI or machine-learning model training apply to all recipients and transfers, including those providers and agents. We don’t sell it or use it for advertising.

## What happens when I disconnect an account or leave?

Removing a mailbox or calendar stops syncing that item, and our copies of its mail or events are deleted within 30 days. Removing one calendar keeps the account connection and permission. A shared Google permission is retained while another connected Email or Calendar still uses it. Disconnecting the whole Google account stops access in both Email and Calendar and deletes stored permissions; our copies of its mail and events are deleted within 30 days. For Google accounts you can also withdraw access at any time in your Google account’s permissions. If a company stops paying, it’s paused rather than locked, so everyone can still read and export everything, and its data is deleted 90 days later, with warnings first. The full detail is in our [privacy policy](https://mojobase.ai/privacy).

## What does this website collect?

No cookies. Cloudflare sits in front of mojobase.ai to deliver it and protect it from attacks, and counts visits with Web Analytics, which doesn’t use cookies or follow you to other sites. Our web server keeps a log of requests, including IP addresses, for up to 14 days, to keep the site running and stop abuse.

## Questions people ask

### Where is my data stored?

On our server in Helsinki, Finland, hosted by Hetzner, which also keeps daily copies of the server for 7 days. Each night an encrypted copy of what your team keeps in Mojobase, apart from mail and connected-account logins, goes to Hetzner’s storage in Helsinki and is deleted within 30 days.

### Do AI providers train on my data?

Only the content a feature needs is sent through Mojobase’s own accounts with Anthropic or OpenAI, with model training disabled on those accounts. Mojobase never uses your Google data to develop, improve or train AI models, ours or anyone else’s. If your company uses its own AI key, or you connect your own agent such as ChatGPT, Claude, Gemini, Grok or Hermes, what it reads goes to that provider under your company’s or your own agreement with them.

### Can Mojobase staff read my email?

Nobody at Mojobase reads your connected mail or calendars, except when you ask us to, for example to help with a problem, when it’s needed for security, such as looking into abuse, or when the law requires it.

### Is Mojobase SOC 2 or ISO 27001 certified?

No. Mojobase doesn’t hold SOC 2, ISO 27001 or other security certifications. This page says what it does instead: where the data lives, how each company’s data is kept apart and encrypted, and who and what can read it.

### What happens when I disconnect an account?

Removing a mailbox or calendar stops syncing that item; its copies are deleted within 30 days. Removing one calendar keeps its connection and permission. A shared Google permission stays while another connected Email or Calendar uses it. Disconnecting the whole Google account stops Email and Calendar access and deletes stored permissions; copies are deleted within 30 days. You can also withdraw access in your Google account’s permissions.

### What happens to our data if we stop paying?

The company is paused, not locked: everyone can still sign in, read, search and export everything, but nothing new is made. The data is kept for 90 days after the pause, with warnings before anything is deleted.

## Related

- [Privacy](https://mojobase.ai/privacy)
- [How the AI works](https://mojobase.ai/ai)
- [Agents](https://mojobase.ai/agents)
- [MCP server](https://mojobase.ai/mcp)
- [Email](https://mojobase.ai/email)
- [Pricing](https://mojobase.ai/pricing)

---

Source: https://mojobase.ai/security · Updated 7 November 2026