# Security and trust for confidential deal data

> How Mindro protects confidential corporate finance data: SaaS run fully in Europe, one governed environment, full audit trail, TLS 1.2+ in transit, AES-256 at rest and no training on your data.

URL: https://www.mindro.co/security
Last updated: 10 October 2026

**Short answer:** Mindro keeps confidential mandate data in a secure, governed environment. The standard SaaS runs fully in Europe and EU data residency is guaranteed. All confidential client and deal data is processed in one governed environment, every data access is logged by user, tool and time, data is encrypted with TLS 1.2+ in transit and AES-256 at rest, and we do not train on your data.

## Roles and responsibilities

| Party | Role |
|---|---|
| Your firm | Data controller: owns all inputs and outputs |
| Mindro | Data processor under a Data Processing Agreement |
| Sub-processors | Google (Vertex AI / Google Cloud), Weaviate, and Anthropic (Claude) when Claude is used |

## Controls

- **Data residency:** the standard SaaS runs fully in Europe and EU data residency is guaranteed. Additional (non-EU) models are only used if a client explicitly asks for them.
- **One governed environment:** the [company realm](https://www.mindro.co/company-realm) processes all confidential client and deal data in one compliant environment.
- **Classification-based access per tool (Institutional setup):** when other AI tools are connected, Mindro and the client agree which data levels each tool may use, based on the client's NDAs and policies. [Setups for institutions](https://www.mindro.co/institutional)
- **Audit trail:** every data access is logged by user, tool and time, so it is fully traceable and auditable.
- **Traceability:** every figure in a deliverable links to its source document.
- **Encryption:** TLS 1.2+ in transit and AES-256 at rest.
- **Stateless, tenant-isolated processing:** each session is processed independently, isolated from other clients.
- **No training on your data:** we do not train on your data.

## Hosting and deployment

| Setup | Where Mindro runs |
|---|---|
| Standard SaaS (default) | Fully in Europe, with EU data residency guaranteed |
| Your own infrastructure | In the client's own virtual private cloud, or on-premise |
| AWS | An AWS-based setup is possible on request, which also allows OpenAI models |
| Other regions | For international clients, the deployment can be ring-fenced in other regions on request |

[Setups for institutions](https://www.mindro.co/institutional)

## Model choice without renegotiating compliance

Mindro orchestrates Claude, Gemini and Mistral. Switching models does not change the data rules set in the company realm, and you do not need to renegotiate your data processing agreements every time AI capabilities evolve.

[Privacy policy](https://www.mindro.co/privacy-policy) · [Book a briefing](https://www.mindro.co/contact)