Security
Written to be forwarded. If your reviewer needs something that is not on this page, mail security@mentionr.com and we will answer rather than send you a portal login.
We are not SOC 2 certified. We would rather say so than imply it — the honest position is that this page and a completed questionnaire are what we have, and both are available today.
Hosting and data
- Where it runs
- Hetzner, Falkenstein and Nuremberg, Germany. Application, database and object storage are all in the EU.
- Encryption in transit
- TLS 1.3 everywhere, HSTS with preload, no plaintext listener.
- Encryption at rest
- Full-disk encryption on every volume; OAuth tokens and 2FA secrets encrypted at the column level as well.
- Data region
- Set when the organisation is created and immutable afterwards.
Access
- Two-factor authentication
- TOTP with ten single-use recovery codes. Never SMS.
- Single sign-on
- SAML and OIDC on Enterprise. We do not market SSO on a self-serve tier.
- Internal access
- Least privilege, individually named accounts, no shared credentials, and every staff action against customer data in an append-only audit log.
- Session security
- Encrypted session cookies, SameSite=Lax, Secure, HttpOnly; session fixation protection on every privilege change.
Resilience
- Backups
- Nightly full, fifteen-minute incrementals, retained 30 days, encrypted, stored in a second region.
- Restore testing
- Quarterly, into an isolated environment, with the result recorded. Last test: 2026-07-14.
- Monitoring
- Error tracking with PII scrubbed and request bodies never captured on auth routes.
Incidents and deletion
- Incident response
- We notify affected customers without undue delay and within 72 hours of becoming aware, with what we know at the time rather than after the investigation closes.
- Deletion
- Close your account and everything is purged after thirty days. Reddit content deleted by its author leaves within 24 hours regardless.
- Security contact
- security@mentionr.com, also published in our security.txt. We will acknowledge a report within one business day.
Questions your reviewer still has?
Mail security@mentionr.com. A named person answers, usually the same day.