Your key can change live prices.Here is how we treat it.
MetaRun asks for an App Store Connect API key that can reprice your apps, edit your listings, and submit releases. That deserves a straight explanation of where the key lives and what can act with it, not a wall of badges. This page is that explanation.
01 · Where your key lives
Envelope encryption, end to end
- 1
You upload the key once, over TLS
Your App Store Connect .p8 key goes straight to our server over an encrypted connection. Before anything is stored, we validate it against Apple's API to confirm it works.
- 2
It is sealed with envelope encryption
A fresh AES-256-GCM data key encrypts your credential. That data key is itself encrypted ("wrapped") by a master key that lives in a separate secrets vault, never in application code, configuration, or environment files.
- 3
The ciphertext is stored out of reach
The encrypted credential sits in a database table that the browser-facing API cannot read at all. Only the server's privileged service role can touch it, and your own dashboard session cannot query it either.
- 4
It is decrypted only at the moment of use
When you (or MILO, on your instruction) act on your store, the server decrypts the key in memory, signs the Apple API request, and discards the plaintext. Secrets are masked from logs by a dedicated redaction layer.
- 5
Your browser never holds it
At no point does the key, encrypted or not, travel back to your browser, appear in a page, or live in local storage. Delete it any time from Settings and the ciphertext is gone.
02 · What can act with it
The model proposes. Only you dispose.
Preview before every write
Every change to your store, whether you click it or ask MILO for it, first produces a before/after preview. Nothing is sent to Apple at this stage.
The AI cannot press the button
MILO's chat and voice agents are structurally limited to reading and previewing: the apply step is rejected at dispatch, not just hidden. Only your explicit ENGAGE click (or your IDE's approval, over MCP) executes a change. Submitting for review additionally requires a typed acknowledgement.
Confirmation tokens catch drift
Each preview is fingerprinted (a SHA-256 token over the exact change). If the store changed between your preview and your click, the apply is rejected instead of writing something you never saw.
Everything is recorded and revertible
Every applied change, from every surface (dashboard, chat, voice, IDE), lands in a permanent change history with a redacted diff, and almost all of them can be reverted in one tap.
03 · The rest of the platform
Defense in depth, not a checkbox
Row-level security on every table
Your data is isolated at the database layer, not just in application code: every table enforces ownership per user, so one account can never read another's rows.
Hardened sessions and headers
Cookie-based sessions with PKCE OAuth, SameSite cookies, a strict Content-Security-Policy, HSTS with preload, and frame-ancestors denied: the app cannot be embedded or script-injected from outside origins.
IDE tokens are hashed, revocable secrets
MCP personal access tokens are shown to you exactly once; we store only a SHA-256 hash. Revoke any token instantly from Settings.
Uploads verified by content, not by name
Image uploads are checked by magic bytes, never by the filename or the declared content type.
We never see your card
Payments run through Paddle as merchant of record. Card numbers, billing addresses, and tax handling live with Paddle, not on MetaRun's servers.
AI runs server-side, away from your secrets
MILO's model calls use our server-side API key. Your platform credentials are never part of a prompt, and your data is not used to train AI models. MILO's memories about your preferences are visible and editable by you in Settings.
04 · Honest limits
What we do not claim
MetaRun is a young product from a small studio. We do not yet hold a SOC 2 report or an external audit certificate, and we will not pretend otherwise with a badge wall. What we can offer today is an honest, inspectable design: the architecture above is how the product actually works, and the safest key is one that can act only where you point it. We recommend creating a dedicated App Store Connect API key for MetaRun so you can revoke it independently at any time, from Apple's side, in one click.
Found a vulnerability, or something that does not match this page? Write to support@hysa-tech.com and it goes straight to the founder. Good-faith security research is welcome and will never be met with legal threats.
Keys stay sealed
14-day free trial. No credit card. Delete your key any time.