How we keep your project safe.

Encryption

Every byte is encrypted in transit and at rest.

• In transitTLS 1.3 with modern ciphers; HSTS preload submitted.
• At restAES-256 on the application database and backups.
• Browser cacheslocalStorage is scoped per origin and can be disabled with setConsent({ storage: false }).

Authentication and access

• Studio sign-inemail + magic link or password, with rate-limited login attempts.
• Public browser keyscoped to a single project and a list of allowed origins. Compromised? Rotate from Studio.
• Project permissionsevery Studio action is scoped to the project the user has access to.

Sensitive actions in your product

Mentoor never has a path to your backend. The agent mode can only perform UI actions on elements you explicitly mark with data-mentoor-agent="allow" — destructive controls stay off-limits unless your code opts them in.

Compliance roadmap

SOC 2 Type I: in progress, targeting H2 2026.

GDPR: in scope from day one — see the DPA for details.

Pen tests: annually, with the most recent summary available on request.

Report a vulnerability

Email [email protected] with a description and a proof of concept if you have one. We acknowledge within 1 business day and aim to resolve high-severity issues within 7 days.

We do not currently run a public bug bounty, but we credit (and pay) responsible disclosure on a case-by-case basis.