Security
How we protect your data.
How MindVault handles data, where we stand on certifications, and how to report a vulnerability.
- Last updated
- Last updated
- Scope
- Applies to the MindVault platform
1. How the product handles data
The MindVault sensor sends behavioral interaction patterns, with device and session identifiers, to MindVault's scoring service. The service returns a confidence verdict to the destination your organization chooses. We collect this data only to measure confidence in who is operating a session, and we handle it as sensitive security data.
2. Security practices
We protect data in transit, limit access to production systems, and review our controls as the product grows. During a security review, we walk your team through our architecture, data handling, and controls in detail.
3. Certifications
MindVault is not currently certified under SOC 2 or ISO 27001. We are building our controls with both frameworks in mind and will update this page as that changes. We are transparent about this because trust requires honesty about where we are, not where we intend to be.
4. Responsible disclosure
We welcome good-faith security research. If you believe you have found a vulnerability in any MindVault system, email info@mindvaultinc.com with a description and a way to reach you. Please do not include real credentials or other people's personal data. We aim to acknowledge reports within 2 business days and will work with you toward a fix. We will not pursue legal action against researchers who act in good faith and follow this policy.
5. Service providers
MindVault uses trusted third-party providers for website hosting, cloud infrastructure, and communications. A current list is available on request.
6. Questions
For security questionnaires, architecture documentation, or a security review, contact info@mindvaultinc.com.