Security

We protect your data the way you would.

Transparent architecture, customer-visible Mintok access logs, and database-level tenant isolation. Built for procurement reviews on day one.

Design principles

Six non-negotiables every decision is measured against.

Tenant isolation enforced at the database

Postgres Row-Level Security policies sit below the application layer. Even a misconfigured query returns zero rows of another customer's data.

Mintok cannot read your data silently

Every access by Mintok-internal personnel requires a Just-In-Time grant with a stated reason, time-boxed to 1 hour by default. You see every grant in real time and can revoke it instantly.

Subprocessors are named and auditable

We publish every third party that processes customer data, what they do, and where they operate. Changes get 30 days' notice; you can object before any change takes effect.

LLM calls honor Zero Data Retention

When agent features send context to Anthropic, our ZDR agreement means no prompt is logged or retained. Your workload data never trains a model.

Customer rights are first-class product features

Export your data, delete your account, and audit Mintok access — all self-serve. No "email us a request" workflow.

Same security bar across all tiers

Free is not less protected than Enterprise. The data footprint differs; the protection model does not.

Architecture in one slide

The layers between your request and your data.

PUBLIC INTERNET  (TLS 1.2+)
        │
        ▼
EDGE  (Vercel)
  ├─ CSP headers + WAF + DDoS protection
  └─ Preview gate (alpha phase)
        │
        ▼
APPLICATION  (Next.js, server-rendered)
  ├─ Clerk middleware  (auth, session)
  ├─ resolveIdentity   (Clerk → User row)
  ├─ getAuthContext    (orgId + permissions matrix)
  └─ RBAC v2           (module-level read/write per role)
        │
        ▼
DATABASE  (Neon Postgres)
  ├─ Encryption at rest (AES-256) + in transit (TLS)
  ├─ Role: mintok_app (NOBYPASSRLS)
  ├─ Row-Level Security policies on all tenant tables
  └─ Tenant context via SET LOCAL app.current_org_id
        │
        ▼
DATA  (yours — fully scoped)

Just-in-time access

Mintok cannot read your data without you seeing it.

Every Mintok-internal access to a customer org requires a logged, time-boxed grant with a stated reason. The grant — and every action taken under it — appears in your dashboard's /setup/settings/security page in real time. Your admin can revoke any active grant instantly.

Read access is self-granted by a Mintok support engineer with a justified reason. Write access (modifying customer data) requires explicit customer approval and is the rare exception — used only when needed to remediate an issue you've escalated.

Subprocessors

Every third party that handles your data. Changes require 30 days' notice.

Vendor	Role	Region	Certifications
Vercel	Hosting, CDN, edge	US + global edge	SOC 2 Type II, ISO 27001
Neon	Primary database	US East	SOC 2 Type II
Clerk	Authentication	US	SOC 2 Type II
Stripe	Payment processing	US + EU	PCI DSS L1, SOC 2 Type II
Anthropic	LLM API (Claude)	US	SOC 2 Type II + ZDR
Cloudflare	DDoS protection (via Vercel)	Global	SOC 2 Type II

ZDR = Zero Data Retention agreement — prompts are not logged or retained for training.

Your rights over your data

Self-serve, in-product. No support tickets to wait on.

Framework	Article / §	What we implement
GDPR (EU)	Articles 15, 16, 17, 20	Access, rectification, deletion, portability
CCPA (California)	§1798.100, §1798.105, §1798.106	Right to know, delete, correct
UK GDPR	Articles 15, 16, 17, 20	Same as EU GDPR

Compliance roadmap

Where we are and where we're heading.

●GDPR / CCPA — Customer rights endpoints (export, deletion) are shipping with the launch wave. See Privacy Policy.
●DPA — Standard Article 28 processing agreement available for Enterprise customers. Download.
○SOC 2 Type II — In progress. Target Q1 2027.
○ISO 27001 — On the roadmap; pursued based on international demand.

Found something? Tell us.

Security questions, vulnerability reports, or audit follow-ups — security@mintok.ai. We acknowledge within 24 hours.