The overall programme: scope, principles, roles and how every other policy on this site fits together.
01Purpose and scope
This policy sets out how Mentornity protects the confidentiality, integrity and availability of the information entrusted to it by the organisations that run mentoring and coaching programmes on the platform, and by their participants.
It covers the Mentornity web application, the admin panel, the public API and webhooks, the AI assistant and MCP connector, e-mail delivery, video meetings, and the infrastructure, people and suppliers that operate them.
02Principles
- Least privilege. People, services and machine identities get only the access their task needs, scoped by role, by resource tag and by region.
- Defence in depth. Network isolation, authenticated and authorised API routes, encryption in transit and at rest, and monitoring are layered so that no single control carries the whole load.
- Everything as code. Servers, networks, permissions, alarms and deployments are defined in version-controlled Terraform, Ansible and CI workflows, and change only through reviewed pull requests.
- Data minimisation. The platform stores what a programme needs to run, logs keep what operations need for 30 days, and secrets never appear in logs.
- Verify, do not assume. Every check that guards production is tested by deliberately injecting the failure it is meant to catch.
03Roles and responsibilities
| Role | Responsibility |
|---|---|
| Executive management | Owns this policy, approves access to production, and is the escalation point for security incidents. |
| Engineering | Builds and reviews changes against the Secure Development Policy and the OWASP controls, and operates the infrastructure. |
| Customer organisation | Controller of its programme data: decides who is invited, which roles they hold, what is collected in forms, and how long the programme runs. |
| Mentornity | Processor of programme data on the customer’s instructions, and controller only for its own website visitors and customer contacts. |
04Policy set
This policy is supported by the more specific policies published in the Mentornity Security Center: access control, encryption, data protection, log management, vulnerability and patch management, secure development, OWASP Top 10 controls, supplier risk management, incident response, backup and recovery, business continuity, AI and data use, and responsible disclosure.
05Review
Policies are reviewed at least once a year and whenever the architecture changes. The date at the top of each page is the date of its last substantive change.
06Contact
Questions about this policy, security questionnaires and Data Processing Agreement requests: privacy@mentornity.com.