Security & Data Protection | MaschinMind
Hosting, access controls, encryption, backups and data protection at MaschinMind.
Concrete information for your security review. This overview distinguishes implemented controls, recorded verification and service commitments agreed in your contract.
General information reviewed: 20 September 2026. Infrastructure evidence: August 2026; this is not a live infrastructure audit.
Where are the data hosted?
Our recorded configuration places the API on Render in Frankfurt and the PostgreSQL database on Neon in AWS Frankfurt. Independent backups use a private Cloudflare R2 bucket with EU jurisdiction. Supporting processing, including provider support and service metadata, may involve locations outside the EEA; EU hosting does not mean that every processing activity takes place exclusively in the EU.
How is access separated?
Customer organisations are logically separated. The application checks organisation membership and permissions on the server. Roles control access to functions and records. Platform administration has privileged access; the support workflow records the reason, expiry and start/end of support sessions. Operational history records actors and relevant events.
How are accounts protected?
Passwords are stored as bcrypt hashes. Authentication sessions expire and logout revokes the current session. TOTP multi-factor authentication and recovery codes are implemented for the platform owner. Customer administrators and operators do not currently have a self-service MFA activation flow. MFA is not represented as mandatory for all accounts.
Are data encrypted?
Public application connections use HTTPS/WSS. Render provides managed TLS for public endpoints. Neon states that database data are encrypted at rest with AES-256 and connections use TLS 1.2 or later. Independent backups of the database and application files are additionally encrypted with age before upload. These are transport and storage protections, not end-to-end encryption.
How do backups work?
The database and application files are backed up automatically twice a day by a separate cloud job in Frankfurt, without depending on a local computer. Copies are encrypted with age before upload to a separate private Cloudflare R2 bucket with EU jurisdiction. The private recovery key is kept separate from the backup environment. After upload, each encrypted object is read back and its integrity is checked. A separate monitor checks backup age and recorded recovery tests. Documented retention controls specify a 30-day object lock and lifecycle deletion after 90 days.
Has recovery been tested?
On 25 October 2026, an encrypted cloud backup was downloaded from R2, decrypted and restored into an isolated temporary test database. The test verified row counts across all 116 tables in six schemas, the database migration revision and the integrity of 118 archived application files. The temporary database was removed after verification. Documented recovery objectives are RPO 24 hours and RTO 4 hours, with RTO measured from the documented decision to start disaster recovery. This result does not guarantee continuous compliance or a particular duration for future recovery. Applicable commitments are defined in the customer agreement. Recovery tests are to be repeated monthly and after material changes.
Can we export or delete data?
Authorised administrators can export organisation data as JSON, including document content encoded as Base64. Export and removal of a test operator’s identifying name and email were verified in production on 15 August 2026. This does not establish immediate deletion from all records and backups. Contact us to agree export handling, retention and deletion requirements before transferring an export.
What availability is promised?
The application provides service and database health checks. No monthly uptime percentage is guaranteed by this overview. Support, availability commitments and any service credits are governed by the applicable customer agreement.
DPA, providers and security questions
DPA documentation exists for pilot and SaaS agreements and is completed for each customer. Our supplier records cover Render, Neon and Cloudflare; the applicable list must also reflect any email or other services enabled for the deployment. Request the applicable DPA, provider information or report a security concern at privacy@maschinmind.com.