Security questionnaire: short answers for a security review

MITHUNAI holds no SOC 2 report, ISO 27001 certificate or other attestation, and has not had an external penetration test. It isolates every organisation’s data, authorises every request, encrypts traffic to and from the service, treats ingested content as untrusted, records security-relevant events, and does not train models on your content. The answers below say which controls are in place and which are not yet, each with the page that explains it. For a questionnaire of your own, send it to your MITHUNAI contact.

Compliance

Question	Answer
SOC 2, ISO 27001 or another attestation?	Not yet. See Compliance
HIPAA, or a Business Associate Agreement?	No
A data processing agreement?	Not yet published. Ask your MITHUNAI contact
A list of subprocessors?	Yes, for information. See Subprocessors

Your data

Question	Answer
Where is it stored?	Germany, on Hetzner Cloud. No choice of region yet
Is it used to train models?	No. See Data handling
Is it encrypted in transit?	Yes, TLS 1.2 or 1.3 to and from the service
Is it encrypted at rest?	Partly. Saved connection tokens are encrypted, and keys and links are stored only as hashes. The database and uploaded files are not encrypted by MITHUNAI itself
Can we bring our own encryption keys?	No
How long is it kept?	Until it is deleted. No retention period is set. See Data handling
Can we delete it?	Partly. Sources and conversations yourself; the whole organisation on request
Can we export it?	Not as a bulk export yet. It can be read through the HTTP API
Are credentials in our content protected?	Detected credentials are redacted before indexing; detection cannot catch every format

Access

Question	Answer
Single sign-on with our identity provider?	Planned
SCIM provisioning?	Planned
Multi-factor authentication?	Not yet
Role-based access control?	Yes. See Organisations and roles
How are API keys protected?	Shown once, stored as a hash, revocation and expiry checked on every request
Can MITHUNAI staff see our data?	Through the product, only after you allow support access: read-only, time-limited, excluding conversations, and recorded in your audit history

Application security

Question	Answer
How is our data kept from other organisations?	The organisation comes from the verified credential, never from the request. See Security
Is every endpoint authenticated?	Yes, except the few that answer before a credential can exist, such as health checks and sign-in
Rate limiting?	Yes. See Rate limits
External penetration test?	Not yet
Vulnerability tracking and dependency updates?	Yes

AI

Question	Answer
How do you handle prompt injection in our documents?	Retrieved text is presented to the model as content, not instructions, and answers are checked against their sources. No system can eliminate injection; see Security
Can a connected source reach our internal network?	No. Fetches cannot reach private or internal addresses
Can AI employees act without a person?	Only for kinds of action your Owner or Administrator allows. Some, such as changing access or preparing a payment, always wait for a person. See Approval policy

Operations

Question	Answer
Is there an audit log?	Yes. It cannot be exported yet. See Security
24/7 monitoring and alerting?	Not yet
A security incident response plan?	Not yet written. See Data handling
Breach notification timeframe?	None committed yet
Backups?	A nightly backup and a rehearsed restore procedure. See Data handling
High availability or an SLA?	No. The service runs on one server, with no uptime commitment
Can we run it in our own environment?	Not offered. See Deployment modes
How do we report a vulnerability?	See Security

Account and sign-in

Members

Organisation

Usage

Security, compliance and deployment

Security questionnaire: short answers for a security review

Compliance

Your data

Access

Application security

AI

Operations

​Compliance

​Your data

​Access

​Application security

​AI

​Operations

Compliance

Your data

Access

Application security

AI

Operations