1. Where we stand today
We are a small European engineering team and we describe our security posture literally, without borrowing credibility we have not earned.
We do not hold a SOC 2, ISO 27001 or equivalent third-party attestation, and we do not claim one. We have not commissioned an audit, so there is no report, bridge letter or certification to share. If that changes we will say so here with the actual scope and date.
For a vendor review, our security pack is public:
- Security overview: how the platform is hosted, encrypted, accessed and monitored (this page).
- Data Processing Agreement, which includes this page as its security measures. A signed copy is available on request.
- Sub-processor list, with the purpose, data categories and processing location of each vendor.
- Data retention schedule, with the period for each category of data and how deletion works.
- Privacy policy, cookie policy and terms of service.
For a security questionnaire or a signed DPA, write to [email protected] and you will reach the people who run the systems.
2. Infrastructure and hosting
The platform runs in the European Union: the application and its database are hosted on servers in Germany, and encrypted backups are kept with a separate provider in the Netherlands. The database is replicated across three servers with automatic failover. Production is segregated from development and test environments, and no production personal data is used for development or testing.
Availability is supported by automated monitoring and encrypted backups on a rolling 35-day cycle. Restore procedures are exercised periodically.
3. Encryption
Data in transit is protected with TLS 1.2 or higher on all public endpoints. Data at rest, including databases, object storage and backups, is encrypted using AES-256 or the provider-managed equivalent.
Secrets and API credentials for connected platforms are stored encrypted and are never written to application logs.
MessageMind does not offer end-to-end encryption. The AI agent has to read a message to answer it, so message content is decrypted inside the platform while it is processed, and only the systems and staff allowed by our access controls can reach it.
4. Access control
Access to production systems follows least privilege and is limited to personnel who need it for their role. Administrative access requires individual accounts and multi-factor authentication.
Access rights are reviewed periodically and revoked promptly when a role changes or an engagement ends. Customer data is accessed only to operate the service, to resolve a support request, or where the customer instructs us.
5. Logging and monitoring
Security-relevant events, administrative actions and authentication activity are logged and retained for 12 months. Logs are monitored for anomalies and are used for incident investigation and accountability under Article 32 GDPR.
6. Secure development and vulnerability management
Changes go through peer review before reaching production. Dependencies are monitored for published vulnerabilities and patched on a risk-based schedule: critical issues are addressed as a priority, other issues in the normal release cycle.
We do not currently run a paid bug-bounty programme. Reports from independent researchers are welcome and handled under section 7.
7. Security contact and reporting a vulnerability
Report a suspected vulnerability or security incident to [email protected] with SECURITY in the subject line. Include what you found, how to reproduce it, and the impact you believe it has.
We acknowledge security reports within 2 business days, give an initial assessment within 5 business days, and keep the reporter updated until the issue is closed.
If you are testing in good faith, please do not access, modify or delete data that is not yours, do not degrade the service, and do not disclose the issue publicly before we have had a reasonable chance to fix it. We will not pursue researchers who follow these principles.
8. Incident response and breach notification
Suspected incidents are triaged, contained and investigated, and remediation is tracked to closure. We record what happened, what data was involved and what we changed as a result.
Where we act as processor and become aware of a personal data breach, we notify the affected customer without undue delay and within 48 hours, with the information they need to meet their own Article 33 obligations. Where we act as controller we notify the Garante per la protezione dei dati personali within 72 hours where the breach is likely to result in a risk to individuals, and inform affected individuals where the risk is high.
9. Vendor and sub-processor management
Vendors that may process personal data are assessed before engagement and bound by written data-protection terms. The current list is published on the sub-processor page, with locations and transfer safeguards.
10. What we need from you
Security is shared. Use strong, unique credentials and enable multi-factor authentication, keep your user list current and remove people who leave, grant integrations only the scopes they need, and configure the agent so it cannot take consequential actions without the guardrails you want.
