Security and AI governance

Manhaj is designed as a private AI operating system for a specific business, not a shared template that takes control of the client's infrastructure. The exact controls for an install are documented in its architecture specification and depend on the client's selected providers.

1. Client ownership and isolation

• Production code, configurations, integrations, and business data are intended to live in client-owned accounts.
• Credentials and access remain under client control, with separate environments used where the selected stack supports them.
• Stopping an engagement does not require surrendering the installed system; handover terms are documented in the client agreement.

2. Access and secrets

Installations are designed around least-privilege access, scoped API credentials, protected environment variables, and access removal when it is no longer needed. Secrets should not be embedded in source code or demonstrations.

3. Data handling

Architecture begins with data minimization: only the data needed for an approved workflow should be collected or sent to a provider. Encryption in transit and at rest is supplied by the infrastructure providers chosen for an install and is verified as part of the stack review.

4. AI governance and human oversight

• High-impact decisions should have a named human owner and an escalation path.
• AI outputs are treated as probabilistic and are tested against defined acceptance criteria before production use.
• Logs, alerts, and review checkpoints are included where the workflow and underlying tools support them.
• Permissions, retention, model providers, and failure modes are documented in the architecture specification.

5. Demonstrations and claims

Public kiosks use anonymized or dummy data. This page describes the engineering approach; it does not claim a certification, regulatory approval, or absolute security guarantee. Contract-specific controls take precedence for a client engagement.

6. Report a concern

Send suspected security issues to ahmadbukhari4245@gmail.com with “Manhaj security report” in the subject. Do not include live credentials, personal data, or exploit details beyond what is needed to identify the affected surface; we will arrange a secure follow-up channel.