Mindstamp as controller
Mindstamp decides how to use personal data for account administration, billing, sales, support, service security, and website operations.
Mindstamp trust center
Security, privacy, AI data use and legal documents.
Company details
AECH CO, trading as Mindstamp
550 Teakwood Ave, Satellite Beach, FL 32937, United States[email protected]Data responsibilities
The role depends on the purpose of the processing.
Mindstamp as processor
Mindstamp handles data in customer videos, viewer records, responses, and reports on the customer’s instructions. Mindstamp can be a subprocessor when the customer acts for another controller.
Viewer IP address and location reports
Customers can ask Mindstamp to disable supported IP address and location fields across their organisation’s viewer reports. This reporting control does not erase earlier records or stop network providers from handling connection information needed to deliver and protect the service.
Send the request to [email protected].
Security controls
Restricted production access
Production customer data access is restricted to authorised personnel for support, security and other authorised service work. Administrative accounts for AWS, Heroku, Cloudflare and GitHub use multi-factor authentication. Administrative access is from the United States.
Provider storage encryption
The production Heroku Postgres database uses encryption at rest. Checks on 20 October 2026 confirmed AES-256 default encryption on the inspected Mindstamp S3 buckets. These checks do not cover every provider or historical object.
Incident procedures
Written incident response and data breach procedures cover incident records, containment, recovery and follow-up. An incident response exercise has not yet been recorded.
Retention and recovery
Heroku Continuous Protection and S3 versioning support recovery. A database restore test completed on 28 October 2026, and the temporary test database was removed. The test did not cover full application or media recovery. Return and deletion follow the applicable agreement. Backups, staging copies and old file versions have separate retention rules; their expiry and provider deletion have not all been verified.
Agreements and security reviews
Standard DPA
The organisation owner on a paid plan can complete the standard DPA and download the accepted agreement with its UK transfer schedule. Free trials are not eligible. No separate Mindstamp countersignature is required.
Security evidence
Mindstamp does not currently hold a SOC 2 report or ISO 27001 certification. Contact us for supporting information relevant to your review.
Enterprise SSO
Custom SAML or OIDC requires an Enterprise agreement that sets the scope, fee and delivery terms. Self-service SSO is not available.
AI features and data use
See what data each AI feature uses, which provider receives it and how the result can affect viewers.
Security and privacy questions
Email [email protected] with your questions or the documents your team needs.