> ## Documentation Index > Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt > Use this file to discover all available pages before exploring further. # Security questionnaire: short answers for a security review > Short yes, partial or not-yet answers to the questions a security review asks first, each linked to its page. MITHUNAI holds no certification today. MITHUNAI holds no SOC 2 report, ISO 27001 certificate or other attestation, and has not had an external penetration test. It isolates every organisation's data, authorises every request, encrypts traffic to and from the service, treats ingested content as untrusted, records security-relevant events, and does not train models on your content. The answers below say which controls are in place and which are not yet, each with the page that explains it. For a questionnaire of your own, send it to your MITHUNAI contact. ## Compliance | Question | Answer | | - | - | | SOC 2, ISO 27001 or another attestation? | **Not yet.** See [Compliance](https://docs.mithunai.com/resources/compliance.md) | | HIPAA, or a Business Associate Agreement? | **No** | | A data processing agreement? | **Not yet published.** Ask your MITHUNAI contact | | A list of subprocessors? | **Yes**, for information. See [Subprocessors](https://docs.mithunai.com/trust/subprocessors.md) | ## Your data | Question | Answer | | - | - | | Where is it stored? | Germany, on Hetzner Cloud. No choice of region yet | | Is it used to train models? | **No.** See [Data handling](https://docs.mithunai.com/trust/data-handling.md#what-mithunai-does-with-it) | | Is it encrypted in transit? | **Yes**, TLS 1.2 or 1.3 to and from the service | | Is it encrypted at rest? | **Partly.** Saved connection tokens are encrypted, and keys and links are stored only as hashes. The database and uploaded files are not encrypted by MITHUNAI itself | | Can we bring our own encryption keys? | **No** | | How long is it kept? | Until it is deleted. No retention period is set. See [Data handling](https://docs.mithunai.com/trust/data-handling.md) | | Can we delete it? | **Partly.** Sources and conversations yourself; the whole organisation on request | | Can we export it? | **Not as a bulk export yet.** It can be read through the [HTTP API](https://docs.mithunai.com/api-reference/introduction.md) | | Are credentials in our content protected? | Detected credentials are redacted before indexing; detection cannot catch every format | ## Access | Question | Answer | | - | - | | Single sign-on with our identity provider? | **Planned** | | SCIM provisioning? | **Planned** | | Multi-factor authentication? | **Not yet** | | Role-based access control? | **Yes.** See [Organisations and roles](https://docs.mithunai.com/concepts/organizations-and-roles.md) | | How are API keys protected? | Shown once, stored as a hash, revocation and expiry checked on every request | | Can MITHUNAI staff see our data? | Through the product, only after you allow [support access](https://docs.mithunai.com/administration/support-access.md): read-only, time-limited, excluding conversations, and recorded in your audit history | ## Application security | Question | Answer | | - | - | | How is our data kept from other organisations? | The organisation comes from the verified credential, never from the request. See [Security](https://docs.mithunai.com/security.md#tenant-isolation) | | Is every endpoint authenticated? | **Yes**, except the few that answer before a credential can exist, such as health checks and sign-in | | Rate limiting? | **Yes.** See [Rate limits](https://docs.mithunai.com/api-reference/rate-limits.md) | | External penetration test? | **Not yet** | | Vulnerability tracking and dependency updates? | **Yes** | ## AI | Question | Answer | | - | - | | How do you handle prompt injection in our documents? | Retrieved text is presented to the model as content, not instructions, and answers are checked against their sources. No system can eliminate injection; see [Security](https://docs.mithunai.com/security.md#untrusted-content) | | Can a connected source reach our internal network? | **No.** Fetches cannot reach private or internal addresses | | Can AI employees act without a person? | Only for kinds of action your Owner or Administrator allows. Some, such as changing access or preparing a payment, always wait for a person. See [Approval policy](https://docs.mithunai.com/team/approval-policy.md) | ## Operations | Question | Answer | | - | - | | Is there an audit log? | **Yes.** It cannot be exported yet. See [Security](https://docs.mithunai.com/security.md#audit) | | 24/7 monitoring and alerting? | **Not yet** | | A security incident response plan? | **Not yet written.** See [Data handling](https://docs.mithunai.com/trust/data-handling.md#incident-response) | | Breach notification timeframe? | **None committed yet** | | Backups? | A nightly backup and a rehearsed restore procedure. See [Data handling](https://docs.mithunai.com/trust/data-handling.md#backups) | | High availability or an SLA? | **No.** The service runs on one server, with no uptime commitment | | Can we run it in our own environment? | **Not offered.** See [Deployment modes](https://docs.mithunai.com/trust/deployment-modes.md) | | How do we report a vulnerability? | See [Security](https://docs.mithunai.com/security.md#report-a-security-issue) | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.