MMindGuardRequest a demo
Security & compliance

Built for institutions that take data seriously

Encryption, consent integrity, audit trails and regulatory awareness — engineered in from the start, not bolted on.

Security controls

🔐

Encryption at rest

Student PII — names, emails, dates of birth — is encrypted at the column level with AES-256-GCM. Keys are managed separately from the data and never shipped in code or images.
🔑

Signed, single-use consent tokens

Consent links use HMAC-SHA256 tokens with a random nonce. They are single-use, verified server-side, and hashed at rest so a database leak does not enable replay.
🚦

Rate limiting

Login and registration are limited per IP, demo submissions are limited to 5 per hour per IP, and each consent page is limited to 20 loads per token.
📜

Immutable audit trail

Every consent state change — created, sent, delivered, opened, accepted, declined, expired, revoked, bounced — writes an append-only audit log entry.
🧹

Data minimisation

Only content a student explicitly shares is analysed, and analysed content is not stored between sessions. CSV validators read only whitelisted columns; extra columns are never stored.
🔒

Access control

Role-based permissions gate every action — roster uploads, consent management, analysis and the audit log. Access is limited to institution-authorised staff.

Compliance

Designed for the regulatory reality of education.

FERPA

Student education records are treated with the confidentiality FERPA requires. Institutions stay in control of their data and who can access it.

COPPA

Minors only participate with verifiable parental consent. The age-of-majority threshold is configurable per institution, and parent emails are required for minors on the roster.

Data Processing Agreement

A DPA template is available for your records and can be tailored to your institution before you go live.

SOC 2 roadmap

We operate with SOC 2 principles in mind — least privilege, encryption, audit logging, incident response — and are on a roadmap to formal SOC 2 readiness.

Incident response & transparency

  • Every consent state change is logged with actor, timestamp and metadata — we can reconstruct exactly what happened and when.
  • Security incidents are triaged by the engineering team and affected institutions are notified with a clear summary and remediation plan.
  • Backups of the database are taken daily, and restore is tested on a schedule.
  • Keys and secrets are held in environment-level secret management, not in the repository.

Want the details for your security review?

We'll walk your IT and legal teams through architecture, controls and the DPA.

Request a demo