TLS everywhere, encrypted disks, snapshots and backups, and secrets kept in a managed vault.
01In transit
- Every Mentornity address is HTTPS only. TLS 1.2 and TLS 1.3 are accepted; TLS 1.0 and 1.1 are refused.
- HTTP Strict Transport Security is sent with a two-year max-age and includeSubDomains.
- Certificates are issued and renewed automatically for mentornity.com and for each customer’s own white-label domain, and certificate expiry is monitored.
- Outgoing webhook calls to customer endpoints require TLS 1.2 or later.
- Outgoing e-mail is authenticated with SPF and DKIM.
02At rest
- Every server disk, including the database volumes, is encrypted with AES-256 and keys managed by AWS.
- Daily volume snapshots inherit that encryption.
- Uploaded files are stored in the encrypted database; database backups and attachments kept in Amazon S3 are encrypted server-side.
- Passwords are hashed with bcrypt; one-time-password seeds are encrypted in the database.
03Secrets
- Application secrets are kept in an encrypted, access-controlled secrets store and injected at deploy time; they are never stored in source code.
- Deployment tooling is configured so that secret values are never written to server logs, and the CI pipeline enforces that setting on every workflow.
- Each secret has a documented list of every system that holds it, so it can be rotated without breaking a consumer.
04Contact
Questions about this policy, security questionnaires and Data Processing Agreement requests: privacy@mentornity.com.