Security

Data stays in the workspace region. Passwords use argon2id. Sessions rotate and end after 30 days. Tenant rows are scoped by the workspace, and sensitive answers are encrypted.

Sub-processors: Stripe for card checkout, the email provider for transactional mail, and the regional database and file store. Card numbers never reach Lead MindMap.

The ASVS L2 checklist, backup drill, and incident steps are in the runbooks. Report a suspicious form from the public form page.