Marcus — Enterprise-grade security
Start free
Start free

The security behind Marcus.

Marcus works inside your chats, inbox and company tools — so it’s held to a higher standard. Independently audited, approval-gated and encrypted end to end, with your data staying yours.

Start free Talk to sales

Certified & verified

Independently audited.
Officially verified.

Marcus is audited by independent third parties and published through official app marketplaces — not self-certified.

Start free
ISO 27001 certified
ISO 27001
ISO 42001 certified
ISO 42001
SOC 2 Type II compliant
SOC 2
GDPR compliant
GDPR
EU data residency available
EU Data Residency
EU AI Act ready
EU AI Act

Verified Microsoft Partner.

Marcus is an official Microsoft partner and is published through Microsoft’s official app marketplace. As part of Microsoft’s publisher verification and marketplace review process, our OAuth scopes, security posture, and app listing were reviewed before Marcus was made available to customers through Microsoft’s ecosystem.

The rules

What Marcus does.
What Marcus does not.

Clear rules, enforced in the product — not promises buried in a policy document.

Start free

Marcus does

  • Encrypt everything

    Your data is encrypted in transit and at rest, always.

  • Ask before anything irreversible

    Destructive or sensitive actions pause for human approval. Marcus proposes — you decide.

  • Authenticate through your tools

    Sign-in runs through Slack and Microsoft SSO, so access follows your existing identity controls.

  • Scope access per person

    Role- and permission-based access controls for teams of any size.

  • Log every action

    A full audit trail of everything Marcus does, ready for review.

  • Keep your data in the EU

    EU data residency available, with GDPR compliance built in.

Marcus does not

  • Train on your data

    Your conversations, files and documents are never used to train AI models.

  • Read uninvited channels

    Marcus only sees the content of channels it has been invited to.

  • Act without approval

    Anything irreversible waits for sign-off from a human.

  • Mix data between workspaces

    Every workspace is fully isolated — your data is never shared with other customers.

  • Keep secrets in chat

    Integrations connect through OAuth. Credentials are stored encrypted — never pasted into a conversation.

  • Sell your data

    Your data is yours. We never sell it or share it with third parties for advertising.

Human in the loop

Does the work.
Asks when it matters.

Before anything sensitive, external or irreversible, Marcus stops and shows you the plan. You make the call — and every action lands in the audit log.

Start free

  • Invited, not embedded

    Marcus only reads the channels and conversations it has been invited to.

  • Approval before impact

    Sensitive, external or irreversible actions pause until someone signs off.

  • Every action on the record

    What Marcus proposed, who approved it and what ran — all in the audit log.

Jordan Ellis

Jordan Ellis

@Marcus delete the staging env and the old repo to cut cost.

Marcus

Marcus App

I can remove the staging environment. The repository has 3 open PRs and a commit from today, so I recommend archiving it instead. Review both options below.

acme-platform · last commit 2h ago · 3 open PRs
Jordan Ellis

Jordan Ellis

Good catch. Archive it.

Trusted & secured

SOC 2 · ISO 27001 · GDPR

Stay in control

Enterprise-grade security.
You stay in control.

Marcus is built for company data, with granular permissions, approval controls, audit logs and enterprise compliance.

Start free

Security and data privacy

  • Your data is never used to train third-party AI models
  • Data is encrypted in transit and at rest
  • Every action is recorded in a complete audit log

Compliance and certifications

  • SOC 2 Type II compliant
  • ISO 27001 & ISO 42001 certified
  • GDPR compliant
  • EU data residency available

Stay in control

  • Marcus only sees channels and conversations it has access to
  • Sensitive or irreversible actions can require approval
  • Permissions follow each user’s existing access
  • Administrators can control access by person, team and tool

Questions, answered.

Start free

No. Your conversations, files and documents are never used to train AI models — ours or anyone else’s.

Your data is encrypted in transit and at rest, and EU data residency is available — so it never has to leave the region.

Only what it’s invited to. Marcus reads the content of a channel only after your team invites it, and access follows role- and permission-based controls.

No. Anything irreversible pauses for human approval — Marcus proposes the action, shows the context, and waits for your call.

SOC 2 Type II, ISO 27001 and ISO 42001, with GDPR compliance and EU AI Act alignment. Every action Marcus takes is audit-logged.

Email support@heymarcus.ai. A human reads every report, and we respond fast.

Start free, pay only when you’re ready.

Start free with no card and no sales call — 300 bonus credits on every day you use Marcus, and access to every feature and integration. Paid plans start at $25 per month.

Start free
Give Marcus a task — approve every action