Security at Marcus isn't a feature page; it's a default. Your code is yours, your project files are stored in the EU, and Marcus itself trains no models on them.
Download any project as a ZIP of its files, whenever you like, and walk out with everything Marcus generated.
Project files, the project database and server logs sit on our server in Estonia, inside the EU. The text of each build request is sent to Anthropic's Claude models, which write the code.
Every connection to aimarcus.love runs over TLS 1.3. The session cookie is HttpOnly, Secure and SameSite=Lax, so page scripts can't read it and it never travels over plain HTTP.
Marcus does not train or fine-tune any model on your prompts, your code or your users' inputs. Build requests are processed by Anthropic under Anthropic's own data terms.
Each project's files live in their own directory on the server, and paths are checked so one project can never read another's files, even on the same workspace.
Before Marcus rebuilds, exports, publishes or deletes a project, the server confirms the request comes from its owner. A request from another account gets a 403 and changes nothing.
How we operate
These controls are live on every account now, not items on a roadmap.
You sign in with Google (OAuth with PKCE) or a one-time email link. Marcus never asks for a password and never stores one.
An email link expires after 30 minutes and stops working after the first use. We keep only a SHA-256 hash of it, and link requests are rate-limited per address and per network.
Found a vulnerability? Mail the steps to reproduce to [email protected] and give us reasonable time to fix it before you publish.
Infrastructure
Mail [email protected] with the affected URL and the steps to reproduce it.