Security and trust for confidential deal data
Last updated
Short answer
Mindro keeps confidential mandate data in a secure, governed environment. The standard SaaS runs fully in Europe, and data is stored and processed in Europe by default. All confidential client and deal data is processed in one governed environment, every data access is logged by user, tool and time, data is encrypted with TLS 1.2+ in transit and AES-256 at rest, and we do not train on your data.
What clients say
“We’ve used AI for a while, but the data that matters most was always off the table, it’s simply too confidential. Mindro fixes that. Now my team can work with our real numbers in an environment we trust, and trace every answer back to the source.” Arian Ververs, Managing Director, ICC Consultants
Roles and responsibilities
| Party | Role |
|---|---|
| Your firm | Data controller: owns all inputs and outputs |
| Mindro | Data processor under a Data Processing Agreement |
| Sub-processors | Google (Vertex AI / Google Cloud) and Weaviate (hosted in Europe); Anthropic (Claude) only when the client chooses to use Claude |
Controls
- Data residency: the standard SaaS runs fully in Europe, and data is stored and processed in Europe by default. Anthropic is a sub-processor only for clients that choose to use Claude, and additional setups outside the EU are only configured at a client's explicit request.
- One governed environment: all confidential client and deal data for a mandate, including its target company graph, is processed in one compliant environment, NDA-compliant by design.
- Classification-based access per tool (Institutional setup): when other AI tools are connected, Mindro and the client agree which data levels each tool may use, based on the client's NDAs and policies. How we typically configure access levels
- Audit trail: every data access is logged by user, tool and time, so it is fully traceable and auditable.
- Traceability: every figure in a deliverable links to its source document.
- Encryption: TLS 1.2+ in transit and AES-256 at rest.
- Stateless, tenant-isolated processing: each session is processed independently, isolated from other clients.
- No training on your data: we do not train on your data.
Hosting and deployment
| Setup | Where Mindro runs |
|---|---|
| Standard SaaS (default) | Fully in Europe: data stored and processed in Europe by default |
| Your own infrastructure | In the client's own virtual private cloud, or on-premise |
| AWS | An AWS-based setup is possible on request, which also allows OpenAI models |
| Other regions | For international clients, the deployment can be ring-fenced in other regions on request |
Sovereignty: where client data goes, and who you depend on
Every prompt sends client data and know-how somewhere. Mindro answers both questions:
- Compliance. Storage, embedding, retrieval and inference in Europe by default; tenant isolation and least-privilege agents; AES-256 and TLS 1.2+ encryption; NDA-compliant by design; every access logged; never used for training.
- Independence. Model orchestration sends each task to the model with the right balance of privacy, price and performance. Your data, prompts and firm memory stay yours, whichever model or tool you use.
Model choice without renegotiating compliance
Mindro orchestrates Claude, Gemini and Mistral. Switching models does not change the data rules of the governed environment, and you do not need to renegotiate your data processing agreements every time AI capabilities evolve.
See Mindro on your next mandate
In 30 minutes we show how your team can create IMs, prepare pitches and match buyers from your firm's own knowledge.
Schedule a briefing