Security
How we protect your data, and how to tell us when we have not.
Last updated 22 September 2026.
The controls that are actually in place.
01
Passwords are never stored
Every password is hashed with bcrypt before it is written. Nobody here can read yours, and a copy of the database does not hand anyone a password.
01
Passwords are never stored
Every password is hashed with bcrypt before it is written. Nobody here can read yours, and a copy of the database does not hand anyone a password.
02
Two-factor on any account
Time-based two-factor authentication is available on every plan and set up from Settings. It is yours to turn on, and we do not charge for it.
02
Two-factor on any account
Time-based two-factor authentication is available on every plan and set up from Settings. It is yours to turn on, and we do not charge for it.
03
Permissions, not a shared login
Access is governed by roles carrying named permissions, and you can build your own rather than choose from a fixed list. A person's access can also be limited to named events.
03
Permissions, not a shared login
Access is governed by roles carrying named permissions, and you can build your own rather than choose from a fixed list. A person's access can also be limited to named events.
04
Security events kept for 90 days
Security-relevant actions are recorded with the account, the action, the resource and the originating address. The 90-day limit is enforced by the database itself, not by a cleanup job that might not run.
04
Security events kept for 90 days
Security-relevant actions are recorded with the account, the action, the resource and the originating address. The 90-day limit is enforced by the database itself, not by a cleanup job that might not run.
05
Abuse is rate limited
Twelve separate limits sit in front of sign-in, one-time codes, registration, password reset, token refresh, workspace invitations, Aria and the public event pages.
05
Abuse is rate limited
Twelve separate limits sit in front of sign-in, one-time codes, registration, password reset, token refresh, workspace invitations, Aria and the public event pages.
06
Errors captured in the EU
Application errors go to our own PostHog instance hosted in the EU, with stack traces, so a fault gets diagnosed from the record rather than from a customer's screenshot.
06
Errors captured in the EU
Application errors go to our own PostHog instance hosted in the EU, with stack traces, so a fault gets diagnosed from the record rather than from a customer's screenshot.
Reporting a vulnerability.
01
Tell us before anyone else
Email security@mingloft.com with what you found, how to reproduce it and what you believe it allows. A proof of concept helps. We can take a PGP-encrypted report on request.
01
Tell us before anyone else
Email security@mingloft.com with what you found, how to reproduce it and what you believe it allows. A proof of concept helps. We can take a PGP-encrypted report on request.
02
Stay inside these lines
Do not access, change or delete anyone else's data, do not degrade the service for other people, and give us a reasonable window before you publish.
02
Stay inside these lines
Do not access, change or delete anyone else's data, do not degrade the service for other people, and give us a reasonable window before you publish.
03
We answer within 48 hours
You get an acknowledgement within two days, then an assessment of severity and an expected timeline within five working days.
03
We answer within 48 hours
You get an acknowledgement within two days, then an assessment of severity and an expected timeline within five working days.
04
Critical fixed within 7 days
Critical issues inside seven days and high severity inside thirty. We keep you updated while we work rather than going quiet on you.
04
Critical fixed within 7 days
Critical issues inside seven days and high severity inside thirty. We keep you updated while we work rather than going quiet on you.
05
We will not come after you
No legal action against anyone acting in good faith under these rules, and public credit for the finding if you would like it.
05
We will not come after you
No legal action against anyone acting in good faith under these rules, and public credit for the finding if you would like it.
Scope and honest gaps
What is covered, and what we do not have yet
What is in scope?
www.mingloft.com and its subdomains, and the Mingloft API. If you are unsure whether something counts, ask us before you test it.
What is out of scope?
Social engineering against our staff or our customers, physical security, denial of service, anything requiring physical access to someone's device, and issues in third-party services we use, which belong to that vendor.
Is there a mobile app to test?
No. Mingloft is a web application. If you find a mobile app claiming to be ours, that is itself worth reporting to us.
Do you pay a bounty?
Not at the moment. We offer public credit with your permission, and we would rather say that plainly than imply a reward that is not there.
Do you support single sign-on?
Not yet. Two-factor authentication is available on every account today, but there is no SAML or OIDC single sign-on. We would rather you knew that now than found out during procurement.
Where does the data live?
The application runs on Heroku and Vercel, and error reporting goes to an EU-hosted PostHog instance. Those platforms publish their own compliance certifications, which are theirs and not ours.
Are you certified to a standard?
Mingloft does not hold SOC 2 or ISO 27001 itself. Our infrastructure providers hold their own certifications and we do not present those as if they were ours.
How do I reach you?
security@mingloft.com for anything security related. For everything else, support@mingloft.com, which is monitored during working hours.
What is in scope?
www.mingloft.com and its subdomains, and the Mingloft API. If you are unsure whether something counts, ask us before you test it.
What is out of scope?
Social engineering against our staff or our customers, physical security, denial of service, anything requiring physical access to someone's device, and issues in third-party services we use, which belong to that vendor.
Is there a mobile app to test?
No. Mingloft is a web application. If you find a mobile app claiming to be ours, that is itself worth reporting to us.
Do you pay a bounty?
Not at the moment. We offer public credit with your permission, and we would rather say that plainly than imply a reward that is not there.
Do you support single sign-on?
Not yet. Two-factor authentication is available on every account today, but there is no SAML or OIDC single sign-on. We would rather you knew that now than found out during procurement.
Where does the data live?
The application runs on Heroku and Vercel, and error reporting goes to an EU-hosted PostHog instance. Those platforms publish their own compliance certifications, which are theirs and not ours.
Are you certified to a standard?
Mingloft does not hold SOC 2 or ISO 27001 itself. Our infrastructure providers hold their own certifications and we do not present those as if they were ours.
How do I reach you?
security@mingloft.com for anything security related. For everything else, support@mingloft.com, which is monitored during working hours.
What we commit to.
90
Day retention on security audit logs, enforced by the database rather than a cleanup job
12
Rate limits in front of sign-in, one-time codes, password reset and more
48
Hours to acknowledge a vulnerability report, then 5 working days to assess it