An AI builder you can put through a security review.

Marcus is built for the conditions enterprise software lives under: EU hosting in Estonia, TLS 1.3 in transit, every project isolated in its own directory, sign-in without passwords. Read how each control works below, then test it on a pilot project.

Google or email sign-in, no passwords.

People sign in with their Google account (OAuth with PKCE) or a one-time email link that expires after 30 minutes. Marcus stores no passwords, so there is no password database to leak.

Every project in its own directory.

Each project's files live in a separate directory on EU servers in Estonia. Every file path is checked against that directory, so one project can never read another's files.

Owner checks on every change.

Before Marcus rebuilds, exports, publishes or deletes a project, the server confirms the request comes from its owner. Any other account gets a 403. All traffic runs over TLS 1.3.

Your code leaves with you.

Any project downloads as a ZIP of its own files: HTML, CSS, JavaScript and assets. Your team can read every line before anything goes live, and keep the files if you stop using Marcus.

Commercial terms by email.

There is no self-serve enterprise checkout. Volume, annual terms and invoice billing are discussed by email at [email protected].

A direct line for security reports.

Vulnerability reports go to [email protected], a mailbox read by the team that runs Marcus. The controls behind this page are listed on the security page.

How a pilot runs

From the first sign-in to a project your team can inspect.

1. Review the controls.

Your security team reads this page and the security page: hosting in Estonia, TLS 1.3, one directory per project, owner checks, passwordless sign-in. Each item can be checked against a live project.

2. Sign in, one account per person.

The pilot team signs in with company Google accounts or work email. No shared logins, and no passwords for anyone to reuse.

3. Build a pilot project.

Describe one internal tool or page and let Marcus build it. Only the account that owns the project can rebuild, export, publish or delete it.

4. Inspect the code, then talk terms.

Download the project ZIP and have an engineer read it. If the pilot holds up, write to [email protected] about volume, annual terms and invoice billing.

Questions from security or procurement?

Send them by email with your stack and the checklist your team uses. No intake form, no sales cadence.

Contact enterprise →