Company

Security Policy

Last updated: April 3, 2026

Security is core to what MindFrame does. You share cognitive data with us — data that reveals how you think. We take the responsibility to protect it seriously. This page describes our security posture and how to report vulnerabilities.

Infrastructure

🔐

Authentication

Supabase Auth — JWT tokens with short expiry. Refresh tokens stored in httpOnly cookies. Passwords hashed with bcrypt (never stored in plaintext).

🔒

Encryption in transit

All communication over TLS 1.2 or higher. Forced HTTPS — no plaintext HTTP endpoints.

🗄

Database

PostgreSQL on Supabase with row-level security policies. Encrypted at rest (AES-256). Production DB accessible only from the API service.

⚡

Caching

Redis (Upstash) for response caching. No PII stored in cache. TLS-encrypted connection.

🌐

Hosting

API on Railway; web on Vercel with edge CDN. Automated deploys from main branch with no manual server access required.

📧

Transactional email via Resend. Email content is not cached or stored beyond delivery logs (30 days).

Access controls

Production database credentials are stored as encrypted environment variables — never in code
API keys for Anthropic, Stripe, Resend, and PostHog are stored in Railway environment variables
MindFrame staff do not have routine access to individual user session data
Admin routes are protected by separate authentication beyond standard user auth
Git repository has branch protection on main — all changes require review

Application security

Input validation via NestJS class-validator DTOs on all API endpoints
Rate limiting on AI-heavy endpoints (Anthropic API calls, coach, personalized challenges)
Global exception filter prevents stack traces from leaking in production responses
Content Security Policy headers on all web responses
CORS policy restricts API access to authorised origins
SQL injection prevention via Prisma ORM parameterised queries
Push notification VAPID keys securely stored; subscriptions validated server-side

AI and data handling

Challenge answers and reasoning text are sent to Anthropic's Claude API for scoring — bound by Anthropic's zero-data-retention API agreement
AI responses are cached in Redis with no PII in cache keys
Your cognitive data is never used to train AI models (ours or Anthropic's)
Coach session context is limited to the last 3 sessions — not your full history

Incident response

Personal data breaches are investigated immediately upon detection
Affected users and relevant authorities are notified within 72 hours of confirmed breach (as required by GDPR)
Post-incident reviews are conducted and findings used to improve security posture
Contact: security@usemindframe.com

Responsible disclosure

We appreciate security researchers who help keep MindFrame safe. If you've discovered a vulnerability, please report it responsibly:

Email: security@usemindframe.com

Response time: Initial acknowledgement within 24 hours; full investigation within 72 hours

Language: English preferred

Please include: a description of the vulnerability, steps to reproduce, potential impact, and any proof-of-concept (without causing harm). We will credit researchers who report valid vulnerabilities (if desired).

In scope:

usemindframe.com and api.usemindframe.com
Authentication and session management
Data access controls (can user A access user B's data?)
Injection vulnerabilities (SQL, XSS, CSRF)

Out of scope:

Denial of service (DoS/DDoS)
Social engineering of MindFrame staff
Physical security
Third-party services not under our control (Supabase, Stripe, etc.)
Findings from automated scanners submitted without manual verification

What we don't do

✗ We never sell your personal data
✗ We never use your cognitive session data to train AI models
✗ We never share your data with advertisers
✗ We never store plain-text passwords
✗ We never log sensitive data (passwords, tokens) in application logs

Future commitments

As MindFrame grows, we are committed to:

Pursuing SOC 2 Type II certification (planned for 2026/27)
Publishing an annual transparency report covering security incidents and government data requests
Running regular penetration tests against production infrastructure