Daily operating system security updates, a monthly maintenance window, and dependency scanning to zero known issues.
01Operating systems
- Security updates are installed automatically every day on every server (Ubuntu unattended-upgrades and Amazon Linux security updates).
- A monthly maintenance window applies the remaining updates, including platform and database packages, and reboots only when a kernel or library update requires it.
- Each run is logged on the host and the result is checked before a server is reported as current.
02Application dependencies
- Go services are scanned with govulncheck; the platform was brought to zero reachable known vulnerabilities and is kept there.
- JavaScript bundles are audited for known vulnerabilities and kept on supported runtimes (Node.js 22 for the web application).
- Document and certificate rendering runs on a current, supported browser engine.
03Remediation targets
| Severity | Target |
|---|---|
| Critical | Mitigated within 24 hours, fixed within 7 days |
| High | Fixed within 30 days |
| Medium | Fixed within 90 days |
| Low | Fixed in the normal development cycle |
04Reviews
Mentornity runs structured internal security reviews of the API, the web applications and the infrastructure, and tracks each finding to closure in the code base with a test that keeps it closed. Customers’ own penetration tests are welcome by arrangement.
05Contact
Questions about this policy, security questionnaires and Data Processing Agreement requests: privacy@mentornity.com.