Security
Agencies trust us with client data, so security is built into the product rather than added later. This page describes what is in place today.
Passwords
Hashed with PBKDF2-SHA256 and a unique salt. Passwords found in known data breaches (checked privately with k-anonymity) are rejected.
Two-factor authentication
Authenticator-app TOTP with single-use recovery codes. Two-factor seeds are encrypted at rest with AES-256-GCM.
Sessions
Random 256-bit tokens in HttpOnly, Secure, SameSite cookies. Only a hash is stored. You can see and revoke every active session, and a password reset signs out all devices.
Brute-force protection
Accounts lock after repeated failed sign-ins, and sign-in, sign-up, reset and API endpoints are rate limited.
Roles and isolation
Owner, admin and member roles enforced on the server. Every query is scoped to your agency, with automated tests proving other agencies cannot read your data.
Audit log
Sign-ins, role changes, billing actions, exports and deletions are recorded and visible to owners and admins.
Client portal links
Unguessable 192-bit tokens. Rotate or disable a link at any time. Portal pages are marked noindex.
Encryption
All traffic uses TLS with HSTS. Data is stored on Cloudflare D1 and R2, which encrypt data at rest.
Payments
Handled by our payment provider (Dodo Payments or Stripe). We never see or store card numbers. Webhooks are signature-verified and idempotent.
Browser protections
Content Security Policy, frame blocking, no-sniff, strict referrer policy and same-origin checks on every state-changing request.
Your data
Export everything as JSON and delete your account at any time. Deletion removes your data from our database and stored files.
Availability and recovery
Runs on Cloudflare's global network. The database supports point-in-time recovery. Failed engine checks are refunded automatically.
Sub-processors
Cloudflare (hosting, database, storage, email), our payment provider, and the AI providers that answer your tracked prompts. Prompts and brand names are sent to those providers to obtain answers. The Privacy Policy lists who receives what.
Compliance status
We have not yet completed a SOC 2 or ISO 27001 audit. If your procurement requires one, tell us and we will share our roadmap and answer your security questionnaire.
Report a vulnerability
Email support@mentiongrid.app with details. We acknowledge reports within two business days and will not take action against good-faith research.