Security & trust

• In transit. TLS 1.3 everywhere. HSTS enabled. No HTTP fallback.
• At rest. Sensitive free-text fields (memory facts, conversation messages, share notes, visitor profiles, titles) are encrypted application-side with AES-256-GCM before they hit the database. Database-level encryption is also enabled by our managed Postgres provider, but our app-level layer means a database snapshot alone is not enough to read the contents.
• Keys. Encryption keys live in the platform secret store (Vercel Environment Variables, audited access). Never committed to the repo.

• Postgres. Managed Neon Postgres on AWS, EU region by default. Continuous backups via the managed provider with point-in-time recovery (retention follows the active Neon tier).
• Files. Vercel Blob Storage for uploaded documents and avatars. Private by default; public links are signed and expire.
• Cache. Upstash Redis for non-sensitive read-through caching (rate limits, plan lookups). No personal data or memory contents are stored here.

• Sessions. NextAuth with HttpOnly + Secure + SameSite cookies. Tokens have a short refresh window and rotate on password reset.
• Per-row ownership. Every query is scoped to the authenticated user's id at the SQL layer, not just the application layer. A bug in one route can't leak another account's data.
• API keys. Personal API keys are hashed at rest; the raw key is shown once at creation, never again.

• No training on your data. Your conversations and memory are not used to train Mindola or any third-party model. Period.
• Data export. Every account can export everything it holds (facts, conversations, settings) at any time from Settings → Account.
• Account deletion. Self-serve, and it hard-deletes all rows owned by your account within 30 days (the soft-delete window covers accidental clicks). Backups are purged on the same schedule.

Mindola is run by a small team. We are not yet SOC 2 Type II certified, and we won't pretend we are. Here is what we are doing right now:

• SOC 2 Type II. We are evaluating SOC 2 with Vanta and starting the internal control work. We won't list controls as “in place” until we have signed evidence. For any active control attestations, email info@mindola.ai.
• GDPR. Lawful basis is contract performance for paid users and legitimate interests for free-tier users. A DPA is available on request for team contracts. Data subject rights (access, rectification, deletion, portability) are handled through the self-serve tools above.
• Subprocessor list. Available on request. Today: Vercel (hosting), Neon (Postgres), Upstash (Redis), OpenAI / Google / xAI / NVIDIA / DeepInfra (model providers, where only the specific request data passes through them, with no training).

Working with a regulated industry? Email info@mindola.ai for a security review or DPA.