Safe keeping

• Encryption in transit: all traffic between your device and MindNest uses HTTPS (TLS).
• End-to-end encrypted notes: relationship notes are encrypted on your device with a key derived from a passphrase only you know. We store ciphertext and cannot read it.
• Passwords: stored only as salted bcrypt hashes, never in plain text.
• Minimal collection: we don’t store IP addresses, and we don’t run third-party trackers.

• Signed, expiring access tokens for every request, checked on the server.
• Rate limits on sign-in, sign-up and public forms to slow down password guessing and abuse.
• Administrative access is restricted to a single named account and enforced on the server for every admin action.
• Suspended accounts are signed out of every device immediately.

• Secrets such as API keys live in environment configuration, never in source code.
• Dependencies are pinned and reviewed before upgrades.
• Our AI provider is contractually limited to processing data to provide the service.
• If a breach affects your personal data, we will notify you and the relevant regulators within the time the law requires (for example 72 hours under the GDPR and NDPA).

• Use a unique password you don’t use anywhere else, ideally from a password manager.
• Sign out on shared devices.
• We will never ask for your password by email or chat.

If you believe you’ve found a security vulnerability, please email security@mindnesthq.site with steps to reproduce. We will acknowledge your report within 3 business days and keep you updated.

Please act in good faith: don’t access or change other people’s data, don’t degrade the service, and give us reasonable time to fix the issue before sharing it publicly. We will not pursue legal action against good-faith research that follows these guidelines.