Security and governance
MINEO centralizes AI use inside a single governed environment: every resource has access controls, every interaction can be traced, and spend is capped and measured. This page is a map of the mechanisms that make that possible and where each one is configured.
For formal compliance statements (GDPR, the EU AI Act, data residency, and the policy that your prompts and documents are not used to train models), see the MINEO legal pages. This page documents the in-product controls, not legal commitments.
Access control
Access is layered from the organization down to the individual resource.
| Layer | What it controls | Where |
|---|---|---|
| Organization roles | Administrator vs Member at the organization level — who manages billing, members, and org settings. | Organizations |
| Project roles | Administrator vs Member per project, independent of the org role. | Projects → Members |
| Groups | Grant access to many users at once by adding an organization group to a project. | Projects → Groups |
| Resource permissions | Per-file view / edit / run permissions, plus optional public access, on notebooks, data apps, and other resources. | File system → Permissions, Notebook sharing |
| Assistant permissions | Which users and groups can view or manage each Assistant. | Assistants → Permissions |
| Organization sharing | Worker images, data sources, and Assistants promoted to the organization are visible to every organization member and viewer, regardless of project membership or per-Assistant permissions. Management stays in the origin project. | Organizations → Workspace |
Organization and project roles are independent: a user can administer the organization but only be a member of a given project, or vice versa.
Traceability
Usage is tracked per resource so administrators can see who used what, and when.
- Usage analytics — each Assistant has a Usage tab (organization administrators only) showing access counts, distinct users, and activity over time, filterable by project, user, and period.
- Provider request metadata — requests to the underlying AI providers carry non-identifying traceability fields (organization, project, thread, MINEO surface, deployment environment, and the acting user's identifier) so usage can be attributed and spend reconciled. No personally identifying information, such as user names, is sent to providers.
- Notifications — subscribe to events (pipeline runs, execution errors, project changes) and route them to Email, Slack, or Sentry. See Notifications.
Cost control
AI spend is turned into a budget you can see and cap.
- AI cost limits — per-user weekly and monthly limits, plus organization-wide totals, with progress bars that warn as you approach each cap. See AI Cost Limits.
Module governance
Project administrators can disable whole modules (Threads, Assistants, Pipelines, …) or restrict them to project administrators (Admins). A disabled module is hidden from the sidebar and its creation is blocked by the backend; an Admins module is hidden from members and viewers only. A module can only be restricted relative to the pricing plan, never enabled beyond it. See Projects → Modules.
Secrets and environment variables
Project environment variables are available to notebooks, live apps, and pipelines.
Project environment variables are visible to all project members. Do not store sensitive credentials there. The same applies to worker images — never hardcode secrets in a Dockerfile (see Worker Images → Security best practices).
Authentication
Users sign in through MINEO's identity provider, including common OAuth social providers (see Getting started). Single sign-on (SSO) is available on advanced plans — see Upgrading or contact sales.
Data isolation
Each project is an isolated workspace with its own resources, settings, and permissions. Projects can belong to an organization or exist independently, so teams and clients can be kept separate by design.
See also
- Projects — roles, members, groups, modules, and environment variables.
- Organizations — organization roles and plan management.
- AI Cost Limits — budgets, caps, and consumption monitoring.
- File system → Permissions — per-resource access control.