Skip to main content
MITHUNAI stores your organisation’s data on its servers in Germany and keeps it until it is deleted: nothing is removed on a schedule, and no retention period has been set. You can delete sources and conversations yourself. Deleting or exporting a whole organisation needs a request to MITHUNAI, because there is no self-service path for either yet. Your content is not used to train models.

​
What is stored

Deleted data remains in backups until those backups are replaced. See Backups.

​
What MITHUNAI does with it

  • It is used to answer your organisation’s questions, run its sources and show its analytics, and nothing else. No other organisation can retrieve it.
  • It is not used to train models. The passages relevant to a question are sent to the model provider with the question, under that provider’s terms. See Subprocessors.
  • Credentials detected in your content are redacted before it is indexed. Detection cannot catch every format, so do not rely on it to make a secret safe to ingest.

​
Export and deletion of an organisation

There is no self-service export of an organisation’s data and no self-service deletion of an organisation. Your conversations, sources and analytics can be read through the HTTP API. For a full export or deletion, ask your MITHUNAI contact.

​
Requests from individuals

A person can change their own password, and an Owner or Administrator can remove a member or delete a conversation. Other requests from individuals, such as access to or erasure of their data, are handled by MITHUNAI on request; there is no tooling for them in the product yet.

​
Backups

The deployment includes a nightly database backup and a restore procedure that has been rehearsed. The 30 most recent backups are kept and older ones are replaced. Recovery is to the last completed backup: there is no point-in-time recovery, no second server, and no recovery-point or recovery-time commitment. Whether backups are encrypted and copied off the server is not yet settled; ask your MITHUNAI contact before relying on either.

​
Incident response

MITHUNAI has written procedures for restoring the service when a component fails. It does not yet have a written security incident response plan, a breach notification procedure with a committed timeframe, or monitoring that alerts a person around the clock. To report a security issue, see Security.
Last modified on November 12, 2026