Security & Privacy
Most AI tools use your data to improve their models. MindBacklog doesn’t. Your product intelligence — every signal, document, and MIND context — is encrypted, isolated, and never shared. AES-256 at rest. TLS 1.3 in transit. Your intelligence compounds for you alone.
Infrastructure Security
All data is encrypted at rest using AES-256 encryption. Database, file storage, and backups — every byte is protected even when idle.
All data transmitted between your browser and our servers uses TLS 1.3 with perfect forward secrecy. No unencrypted connections, ever.
Strict data isolation between organizations. Your product data, feedback signals, and MIND context are completely separated from other tenants at the database level.
Granular role-based access control: Organization-level roles (Admin, User, Viewer) and Product-level roles. Team members see only what they should.
Comprehensive audit trail of all administrative actions — invitations, role changes, product modifications. Know who did what and when.
Automated daily backups with point-in-time recovery capability. Your data is durably stored across multiple availability zones.
Compliance & Standards
Building the Product Intelligence Platform means earning trust. We’re meeting enterprise compliance standards from the ground up.
Audit Starting Q3 2026
Operational
Operational
Supported
AI & Your Data
MIND builds deep product context — that makes data privacy even more critical. Here’s our commitment.
Your feedback, roadmap data, MIND context, and documents are never used to train any AI models. Your product intelligence stays yours exclusively — it compounds for your team, not ours.
When AI classifies your feedback or generates a PRD, the data is processed and returned. No customer data is retained in AI model memory or logs beyond the processing window.
Your MIND intelligence engine is completely isolated per organization. One customer’s product context, signals, and compounded intelligence never leaks into another’s AI responses, classifications, or scores.
Our AI infrastructure providers (Google Gemini and locally-hosted LLMs) have data processing agreements that prohibit training on customer data. Locally-hosted models process data entirely within our own infrastructure.
Infrastructure
Hosted on Railway App with enterprise-grade infrastructure and 99.9% uptime SLA. Automated deployments, managed databases, and built-in redundancy.
Cloudflare CDN with DDoS protection, WAF, and rate limiting to prevent abuse and ensure availability.
24/7 infrastructure monitoring with automated alerting. We detect and respond to issues before they impact your experience.
Access & API Security
Authenticated sessions expire after inactivity. Password changes and role revocations force immediate logout across all devices. Session tokens are cryptographically signed and HttpOnly.
The feedback widget, REST API channel, and integrations (like Slack) use token-based or OAuth authentication — no user credentials are exposed. REST API channels support secure API key authentication with optional IP allowlisting. All API endpoints enforce rate limiting and input validation to prevent abuse and injection attacks.
Organization admins have visibility into active sessions. Suspicious login activity triggers notification alerts. OAuth tokens are scoped to the minimum permissions required.
MCP Server Security
The Model Context Protocol server connects external AI clients (Claude, Cursor, ChatGPT) to your backlog. Phase 1 ships with the safest possible launch surface.
Bearer tokens (mb_*) are shown to the user once at creation, then SHA-256 hashed before database storage. Lose the raw token? Revoke and rotate — the database holds no recoverable copy. No exception, no admin override.
Tokens are issued at organization scope or single-product scope. A product-scoped token cannot read other products in the same workspace, even if it’s leaked. Multi-product orgs can issue per-team tokens without cross-leakage risk.
Custom expiry dates per token (default: indefinite). Revoke any token instantly from the dashboard — takes effect on the next request. Demo organizations are blocked from MCP entirely. Trial users on Growth/Scale get full MCP access for the trial period.
18 query tools, zero write surface. Even an exposed token cannot mutate your data — no status changes, no deletions, no comment posts. Mutations stay in-app where confirmation cards live. Write tools are explicitly on the Phase 2 roadmap (Q3 2026), and will require additional explicit per-tool authorization.
MCP access is gated to Growth and Scale plans before any tool runs. Demo and Starter accounts cannot connect. Plan downgrade blocks future MCP requests. Token misuse can be audited via the connection log in Settings → Developer.
The MCP server reuses the same authentication chain as the in-app API — same TLS, same rate limits, same audit log, same incident response. Nothing about the MCP path bypasses the standard security perimeter.
Responsible Disclosure
We take security reports seriously. If you discover a vulnerability, we want to hear about it.
Email [email protected] with a detailed description of the vulnerability, steps to reproduce, and any supporting evidence. Please do not publicly disclose the issue until we've had a chance to address it.
We will acknowledge your report within 48 hours, provide an initial assessment within 5 business days, and keep you informed of our remediation progress. We will not take legal action against researchers who report vulnerabilities in good faith.
Authentication bypasses, data exposure between tenants, XSS, CSRF, SQL injection, and any issue that compromises customer data confidentiality, integrity, or availability.
Social engineering, physical attacks, denial-of-service testing, automated scanning without prior approval, and issues in third-party services we don't control (e.g., Cloudflare, Stripe).
FAQ
No. Your feedback, roadmap data, MIND context, and documents are never used to train any AI models. Your product intelligence stays yours exclusively. Our AI providers (Google Gemini and local LLMs) have data processing agreements that prohibit training on customer data.
Yes. MindBacklog enforces strict tenant isolation at the database level. Your product data, feedback signals, and MIND context are completely separated from other organizations. One customer's intelligence never leaks into another's AI responses. Learn about MIND isolation →
AES-256 encryption at rest for all data (database, file storage, backups). TLS 1.3 with perfect forward secrecy for all data in transit. No unencrypted connections, ever. Session tokens are cryptographically signed and HttpOnly.
We're on track for SOC 2 Type II audit in Q3 2026. We're already GDPR and CCPA compliant and building the infrastructure to meet enterprise compliance standards from the ground up. Contact us at [email protected] for compliance documentation.
Your product intelligence is the most sensitive data you have. Contact our team directly for security inquiries.