Is Manus AI safe? What its own terms say, and the open-source controls a team can inspect

What Manus's own terms say about your content

Manus is operated by Butterfly Effect Pte. Ltd., a company incorporated in Singapore. Its Terms of Use call your inputs and the outputs they generate Your Content, and they state that Manus does not claim ownership of it. As between you and the company, you stay the owner of the rights you had in it (Manus Terms of Use, last updated 28 September 2026).

The same terms ask something in return. You give Manus a worldwide, transferable right to copy, store, modify and otherwise use Your Content to provide, maintain, develop and improve the service and to check your compliance with the terms. That is the trade a hosted product makes: you keep ownership, and the vendor holds broad operational use of the content while the service runs.

Two more points from the same documents. Manus may send the content a request needs to third-party AI providers, and it states it does not authorize a provider to train on Your Content unless it discloses that use and gets any consent the law requires. Its privacy policy adds that it acts as a data processor for a Team Plan Owner, a Space Owner or an API customer, and that those owners decide how that workspace data is processed (Manus Privacy Policy).

Where the data goes and how long it stays is documented as well. Manus is headquartered in Singapore and says personal information may be transferred to the United States or other locations (Manus Privacy Policy, checked October 2026). Retention depends on the feature: data you delete is removed within 30 days unless a legal or security reason holds it longer; a browser sandbox keeps its data for up to 7 days on a free plan and up to 21 on a paid one; task execution logs are kept so a task can be replayed and debugged; and memory, where it is enabled, is kept to support later tasks. Retention for team workspace data is set by the team's Owner or Administrator.

Where the agent and its memory live

On a hosted product, the agent, its configuration and its memory sit in the vendor's product. Manus keeps persistent memory in its own service when you enable it, so a later task can draw on it, and content pulled through a connected account may be retained in conversations, task files, object storage or enabled memory under its policy.

A platform you own puts the same things in files. On Kortix, an agent is agents/<name>.md plus an agents.<name> block in kortix.yaml, memory is files in the project, and the connectors and triggers are declared in the same repo. The repo is the company: versioned, diffable, and readable by the team. That placement is the difference this comparison turns on.

The controls a team gets when it runs Kortix

Kortix is the open-source AI Operating System, so a team can read the code, run it on Kortix Cloud, in its own VPC, or on its own on-prem network, and self-host for free. The controls are in the product, and each one answers a question a security review asks:

• Per-resource permissions for people and agents. Roles, groups, and an audit trail.
• Connector credentials are brokered server-side and never enter the machine.
• Approval gates you set. Off until you set them. An Ask holds a connector call, the agent's turn pauses, and it resumes when a person approves it.
• Session work reaches main through a change request. Merge is default-deny for agents.
• Every action is recorded. Reading, exporting and streaming the audit log depend on the plan.

A connector policy is a file, not a setting buried in a dashboard. This excerpt lets a safe read run on its own and holds everything else for a person:

policies:  - match: "get_*"    action: always_run  - match: "*"    action: require_approval

The fragment comes from Kortix's connector reference (Read the docs). The same rule can be scoped to a person, a group or a single agent.

Where control sits

The point is where control sits, not a claim that any product is unsafe. A person who wants a finished report or a deck without running a server can pick a hosted agent and accept its terms, and that is a fair choice for one person. A team that has to answer a security review asks different questions: who holds the credential, where the memory lives, and who approves a change before it counts. The open-source path answers those because the answers are files the team owns, and the self-hosting guide shows how to run the whole stack itself. The Is Manus open source page covers what is code you can inspect, and the comparison sets the options side by side.