Trust and Security

MindsetOS helps teams build psychological awareness and mindset mastery. We understand that this means people share personal reflections and insights with our platform. Protecting that data is fundamental to the trust our users place in us, and we treat that seriously.

Security at a glance

Measure	Detail
Encryption in transit	TLS 1.2+ on all connections
Encryption at rest	AES-256 encryption
Authentication	Secure session management via BetterAuth
Access control	Role-based access; least-privilege principle
Data hosting	EU/EEA primary hosting via Vercel and Convex
Certification	Cyber Essentials certified
Data protection compliance	UK GDPR, EU GDPR, Australian Privacy Act, CCPA compliant
AI model training	Your data is never used to train AI models

Data privacy and GDPR

MindsetOS complies with applicable data protection laws worldwide, including the UK GDPR, the EU GDPR, the Australian Privacy Act 1988, and US state privacy laws such as the CCPA. We are registered with the UK Information Commissioner’s Office (ICO).

Key privacy commitments:

Individual coaching data is private and never shared with employers. Organisations only receive aggregated, anonymised insights.
We do not sell or rent personal data.
User data is not used to train any AI models.
We process personal development data, not medical or clinical information.
Data Protection Impact Assessments (DPIAs) are conducted for high-risk processing activities.

AI and data processing

MindsetOS uses AI to deliver personalised coaching at scale. Here’s how we keep that safe:

AI coaching conversations are processed via our AI providers with zero data retention: inputs are not stored or used for model training.
All AI API calls are made over encrypted connections (TLS 1.2+).
International data transfers to AI providers are protected by Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA).

Infrastructure and sub-processors

Provider	Purpose	Data location and safeguards
Vercel	App hosting and content delivery	EU/EEA
Convex	Backend storage, access management and monitoring	EU/US (SCCs applied)
OpenAI and Anthropic	AI coaching language processing	UK/US (SCCs + IDTA applied; zero data retention)
Resend	Transactional email delivery	US (SCCs applied)
BetterAuth	User authentication and session management	Self-hosted (data remains within MindsetOS infrastructure)

For enterprise and procurement teams

We understand that enterprise organisations need thorough due diligence. Here’s what we can provide:

Privacy Policy: available at themindsetos.com/privacy
Data Processing Agreement (DPA): available on request; ready to countersign
Sub-processor list: full list with data locations and safeguards (see above)
Security questionnaire responses: happy to complete your standard security questionnaire
Cyber Essentials certification: certified. View our Certificate of Assurance or verify it live.

Questions?

If you have questions about our security practices or need documentation for your procurement process, contact us at admin@themindsetos.com.