Security
Last updated October 27, 2026
Mintforge rents dedicated physical Macs. This page explains how we keep customer hardware separate, what we're responsible for and what you are, and exactly how we erase a Mac when your service ends. It describes our current practices, and we update it when they change.
Dedicated hardware
Each Mac is a physical machine assigned to one customer at a time. There's no virtualization layer, and its CPU, memory and storage aren't shared with other customers. A Mac is only reassigned after it has been erased using the process below.
Who is responsible for what
| Mintforge | You |
|---|---|
| Physical hardware, power and cooling | macOS user accounts and passwords |
| Network connectivity to your Mac's IPv4 address | macOS updates and the software you install |
| Repairing or replacing failed hardware | Firewall settings and the services you expose |
| Erasing the Mac when your service ends | Backups of your data |
| Tailscale, VPN, MDM and other agents you install |
Securing your Mac
- Change setup credentials. Replace any credentials you received during setup, and create named accounts for the people who need access.
- Limit what's exposed. Your Mac is reachable over its IPv4 address. Turn on the macOS firewall and expose only the services you need. Many teams reach the Mac only through Tailscale or their own VPN.
- FileVault and restarts. If you turn on FileVault, the Mac waits for a password at startup after every restart. Use
fdesetup authrestartfor planned restarts, or the KVM add-on to unlock it at the console. - Treat KVM access like physical access. Anyone with access to the KVM add-on can see the screen and type at the console, including in macOS Recovery.
- Keep your own backups. Mintforge doesn't take backups or disk images of customer Macs. The Mac's internal storage is the only copy of your data that we hold, and it's erased when your service ends.
When your service ends
Before your end date
These steps protect your accounts and let the Mac be reused promptly. The erase happens either way.
- Copy off any data you want to keep.
- Sign out of your Apple Account on the Mac (System Settings, then your name, then Sign Out). This turns off Find My and Activation Lock.
- Remove the Mac from your MDM, and release it from Apple Business Manager if it was assigned there.
- Deregister CI runners, and revoke any tokens, keys or signing certificates stored on the Mac.
- Remove the Mac from your Tailscale tailnet or VPN.
How we erase the Mac
- End access. At the end of your service term, we disable network access to the Mac and any KVM access.
- Erase and restore. A member of our team connects the Mac to a Mintforge-controlled Mac and restores it in DFU mode using Apple Configurator. This erases the internal storage and reinstalls the Mac's firmware and macOS.
- Verify. We start the Mac and confirm it opens to Setup Assistant with no user accounts, and that Activation Lock is off.
- Record. We log the Mac's serial number, the date, the method used and who performed the erase.
- Reassign. Only after these steps can the Mac be assigned to another customer.
On request, we'll send you written confirmation of the erase, including the serial number and date.
Why this is effective
Macs with Apple silicon always encrypt their internal storage, using keys protected by the Secure Enclave. Erasing the Mac permanently discards those keys, so data written before the erase can't be read back, even by someone with direct access to the storage chips.
If a Mac fails
If a Mac fails in a way that prevents the erase, it stays in Mintforge's custody until it has been repaired and erased, or until its storage has been physically destroyed. It isn't reassigned or resold before then.
Reporting a security issue
If you believe you've found a security issue affecting Mintforge or a customer Mac, email [email protected] with "Security" in the subject line. Please include enough detail for us to reproduce it.
Working through a vendor security review? Send your questionnaire to the same address.