Security Overview

1. Encryption

• In transit: TLS 1.2 or higher for all connections between your device and our servers.
• At rest: AES-256 encryption on primary storage, backups, and offsite replicas.
• Application-layer encryption: additional protection for sensitive fields (conversation content, health data).
• Key management: managed key rotation with audit logging. Keys are never stored alongside encrypted data.

2. Access Controls

• Role-based access with principle of least privilege — engineers and staff access only what their role requires.
• Multi-factor authentication required for all administrative access.
• Every administrative action is logged with actor, timestamp, and purpose.
• Production access requires named authorization and is time-bound.
• Access reviews run at defined intervals; departing employees are removed same-day.

3. Monitoring and Detection

• 24/7 security monitoring and alerting.
• Anomaly detection on authentication, access patterns, and data egress.
• DDoS protection and web application firewall at the edge.
• Runtime intrusion detection and file integrity monitoring on sensitive systems.

4. Secure Software Development

• Code review required for all production changes.
• Automated security testing in CI (static analysis, dependency scanning, secrets scanning).
• Annual penetration testing by independent third parties.
• Vulnerability management program with defined SLAs for remediation by severity.
• Secure coding training for engineers, refreshed annually.

5. Incident Response

• Defined incident response plan with classification, escalation paths, and communication protocols.
• Dedicated response team available 24/7.
• Post-incident review after every incident to improve defenses.
• If a breach affects personal data, we notify affected users within 72 hours of discovery and notify regulators as required by GDPR, DPDP, HIPAA, and applicable state laws.

6. Business Continuity and Disaster Recovery

• Geo-redundant backups with automated replication.
• Defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets, tested regularly.
• Infrastructure-as-code enables rapid rebuild in a recovery region.
• Regular disaster-recovery drills.

7. Data Protection by Design

• Minimum necessary principle — we only collect data required for the feature.
• De-identification before data leaves HIPAA-aligned infrastructure (AI processing, analytics).
• Separation of duties — staff who can access production data cannot also approve their own access.
• Defined data classifications (public, internal, confidential, restricted) with handling rules.

8. Training and Culture

• Security and privacy training required for all new hires and refreshed annually.
• HIPAA and data protection training for all staff with access to Protected Health Information.
• Phishing simulations run regularly.
• A named Security Officer and Privacy Officer are accountable for the program.

9. Audits and Attestations

• HIPAA-aligned: our security program implements HIPAA administrative, physical, and technical safeguards. We are not a HIPAA covered entity and do not claim HIPAA certification.
• SOC 2 Type II: security program controls aligned with SOC 2 Type II requirements; formal attestation in progress.
• COPPA / DPDP / GDPR: program controls mapped to applicable requirements for each regime.
• Independent penetration testing: annual minimum; reports available to corporate customers under NDA.

10. What You Can Do

• Use a strong, unique password. Consider a password manager.
• Enable multi-factor authentication when we offer it on your account.
• Don't share your login.
• Tell us immediately if you suspect something is wrong: support@menthra.ai.

11. Related Documents

• Privacy Policy
• Subprocessor Categories
• Your Rights