Security at Mindstamp.

Production customer data access is restricted to authorised personnel for support, security and other authorised service work. Administrative accounts for AWS, Heroku, Cloudflare and GitHub use multi-factor authentication. Administrative access is from the United States.

Users can sign in with email and password or Google. Users can revoke API tokens. OAuth connections use the scopes the customer grants; API bearer tokens have the connecting user’s API access.

Custom SAML or OIDC requires an Enterprise agreement that sets the scope and delivery terms. Self-service SSO is not available.

The production Heroku Postgres database uses encryption at rest. Checks on 20 October 2026 confirmed AES-256 default encryption on the inspected Mindstamp S3 buckets. These checks do not cover every historical object or external provider.

Core application processing is in the United States. The default Bunny Stream library uses storage replicas in Germany, the United Kingdom, Sweden, the United States, Singapore, Australia and Brazil.

Enterprise media can use a separate library with agreed regional storage settings. This does not localise the application, support, AI processing or the full delivery chain. Review the provider directory and your processing profile for the services you use.

Heroku Continuous Protection and S3 versioning support recovery. A database restore test completed on 28 October 2026, and the temporary test database was removed. The test did not cover full application or media recovery.

Backups, staging copies and old file versions have separate retention rules. A completed backup does not prove that older copies have expired.

Return and deletion follow the applicable agreement and processing profile. Live records, provider copies, old file versions and backups have different retention rules. Mindstamp does not promise one deletion period for all records.

Provider deletion and expiry of older copies have not all been verified. Contact [email protected] for a data request or the process that applies to your account.

Written incident response and data breach procedures cover records, containment, recovery and follow-up. A completed incident exercise has not yet been recorded.

Report a security concern to [email protected]. Include the affected feature, time and steps to reproduce when possible. Do not send passwords, API keys or unnecessary customer data.

Mindstamp does not currently hold a SOC 2 report or ISO 27001 certification. A provider’s certification is not a certification of Mindstamp.

The public security and AI pages describe the current controls and their limits. Ask for the evidence that applies to your review. Enterprise questionnaires and custom terms are scoped separately. Internal operating policies and incident records are not public downloads.