> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Shared responsibility: what MITHUNAI and you control

> MITHUNAI runs the hosted service and its controls; your organisation controls its people, keys, sources and AI employee approvals. The split, with gaps.

MITHUNAI operates the hosted service: the infrastructure it runs on, the application and its security controls, isolation between organisations, backups, and the model and email providers it uses. Your organisation controls who has access, the API and widget keys it creates, which sources it connects and what their tokens can read, and which AI employee actions may run without a person. The table describes who does each job today; it is not a contractual allocation.

## The hosted service

| Area | Who | Today |
| - | - | - |
| Data centre and hardware | Hosting provider | Hetzner Cloud, Germany. See [Subprocessors](https://docs.mithunai.com/trust/subprocessors.md) |
| Servers, operating system, network edge, TLS certificates | MITHUNAI | Only the TLS edge is reachable from the internet |
| Application code, security controls and vulnerability fixes | MITHUNAI | See [Security](https://docs.mithunai.com/security.md) |
| Isolation between organisations | MITHUNAI | See [Security](https://docs.mithunai.com/security.md#tenant-isolation) |
| Databases, file storage and backups | MITHUNAI | See [Data handling](https://docs.mithunai.com/trust/data-handling.md#backups) |
| Monitoring and incident response | MITHUNAI | Not yet in place to the standard an enterprise review expects. See [Data handling](https://docs.mithunai.com/trust/data-handling.md#incident-response) |
| Model provider and email provider accounts | MITHUNAI | They process data under their own terms |
| Allowing MITHUNAI support into your organisation | Your organisation | Off until an Owner or Administrator allows it. See [Support access](https://docs.mithunai.com/administration/support-access.md) |
| People: invitations, roles, removal | Your organisation | See [Members](https://docs.mithunai.com/administration/members.md) |
| API keys and widget keys: creating, scoping, revoking | Your organisation | See [API keys](https://docs.mithunai.com/administration/api-keys.md) |
| Which websites may load your widget | Your organisation | Within what the deployment allows. See [Allowed origins](https://docs.mithunai.com/channels/widget.md#allowed-origins) |
| Which sources to connect, and what each saved token may read | Your organisation | What a token can read, your assistant can quote to anyone who can ask it |
| What your content contains | Your organisation | MITHUNAI redacts credentials it detects, and nothing more |
| Which AI employee actions wait for a person, and approving them | Your organisation | Some actions always wait and cannot be switched off. See [Approval policy](https://docs.mithunai.com/team/approval-policy.md) |
| Deleting conversations and sources | Your organisation | Console and API |
| Deleting the whole organisation, or exporting its data | MITHUNAI, on request | There is no self-service path yet |
| Tools you connect to AI employees (helpdesk, CRM, mailbox, identity provider) | Your organisation | Under your own contract with that vendor |
| Notices to the people who use your widget | Your organisation | -- |

## Your own environment

MITHUNAI is not offered for your own cloud account or your own hardware today. See [Deployment modes](https://docs.mithunai.com/trust/deployment-modes.md).

## Related pages

* [Data handling](https://docs.mithunai.com/trust/data-handling.md): what is stored, for how long, and how it is deleted.
* [Security questionnaire](https://docs.mithunai.com/trust/security-questionnaire.md): short answers to the questions a security review asks.
* [Compliance](https://docs.mithunai.com/resources/compliance.md): what MITHUNAI can and cannot claim.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.