--- title: "Technical and Organizational Measures (TOM) | Minds" canonical_url: "https://getminds.ai/legal/tom" last_updated: 2026-10-09 meta: description: "Last Updated: October 9, 2026" "og:description": "Last Updated: October 9, 2026" "og:title": "Technical and Organizational Measures (TOM) | Minds" "twitter:description": "Last Updated: October 9, 2026" "twitter:title": "Technical and Organizational Measures (TOM) | Minds" --- Minds October 9, 2026·Minds Team # **Technical and Organizational Measures (TOM)** Last Updated: October 9, 2026**Last Updated: October 9, 2026** Art of X UG (haftungsbeschränkt) ("Minds") implements the following technical and organizational measures pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk involved in the processing of personal data. --- ## 1. Access Control ### Physical Access Control Minds infrastructure is hosted exclusively with certified cloud providers: - **DigitalOcean** – Frankfurt, Germany data center (EU). Certifications: SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018. - **Supabase** – Stockholm, Sweden data center (EU), hosted on AWS. Certifications: SOC 2 Type II. Physical security (biometric access controls, 24/7 surveillance, access logging) is fully managed by the cloud providers. The certifications listed above are provider certifications and do not represent that Minds itself currently holds a SOC 2 report or ISO certification. ### Logical Access Control - Role-based access control (RBAC) for all internal systems and administration interfaces. - Multi-factor authentication (MFA) required for all employee access to production systems. - Individual user accounts – no shared credentials. - Regular review and revocation of access rights following the principle of least privilege. - API keys and credentials are managed in encrypted secrets managers. - OAuth tokens, integration credentials, and API keys are scoped, encrypted at rest, and revocable. --- ## 2. Encryption ### Encryption in Transit - All data transmissions are secured via TLS 1.2 or higher. - HSTS (HTTP Strict Transport Security) is enabled for all public endpoints. - Internal service-to-service communication is also encrypted. ### Encryption at Rest - Databases (Supabase/PostgreSQL) use AES-256 encryption for data at rest. - Storage access is restricted by bucket and service controls. Backup files require encryption in transit and at rest. - Backup files must remain encrypted and isolated from ordinary application use. --- ## 3. Data Separation (Tenant Isolation) - Tenant separation uses application authorization and database access controls, including Row-Level Security where configured. - Cross-tenant access must be denied; coverage is validated through scoped negative tests. - Automated tests check defined tenant boundaries; broader control validation remains in progress. --- ## 4. Availability and Resilience ### Hosting Architecture - Application runs on DigitalOcean App Platform with automatic scaling and health checks. - Supabase hosts the production PostgreSQL database in Stockholm, Sweden (eu-north-1). ### Backup and Recovery - Daily physical database backups are retained according to the applicable provider plan. They contain Storage metadata, not the stored file bytes. - Point-in-Time Recovery (PITR) is disabled in the current production configuration (October 9, 2026). - Recovery procedures must be tested regularly; independent Storage recovery and other open recovery findings are being validated. - Recovery objectives are operational targets unless an Order Form expressly makes a specific target contractually binding. --- ## 5. Incident Response - Documented incident response process for security incidents. - Notification of the Controller (customer) within **24 hours** of becoming aware of a personal data breach, in accordance with the Data Processing Agreement (DPA). - Logging and tracking of all security-relevant incidents. - Regular review and update of the incident response plan. --- ## 6. Confidentiality and Employee Obligations - Employees and contractors must be subject to confidentiality obligations before authorized access; supporting records are incomplete. - Personnel must complete assigned privacy and security training; completion records are incomplete. - Obligation to maintain data secrecy in accordance with GDPR. - Access to personal data is granted only on a need-to-know basis. --- ## 7. Subprocessor Management - Careful selection of sub-processors based on data protection and security criteria. - Contractual obligation of all sub-processors to GDPR-compliant data processing. - Regular review of sub-processors. - Current list of sub-processors is available at [Subprocessors](https://getminds.ai/legal/subprocessors). - Advance notice to customers of any changes as per the DPA. --- ## 8. Logging and Monitoring - Centralized logging of system events and access. - Audit logs cover API/MCP access, OAuth and integration changes, and security-relevant administrative actions. - **In-house AI observability** for monitoring and tracing AI model interactions (on Minds infrastructure in the EU; no separate observability provider). - **PostHog** for product analytics and optional session replay - persistent analytics/session replay only with analytics consent; limited cookieless diagnostics where lawful. - Monitoring of critical system metrics with automated alerts. - Regular review of logs for anomalies. --- ## 9. Data Minimization and Pseudonymization ### Data Minimization - Collection and processing of only those personal data that are necessary for the respective processing purpose. - Regular review of processed data categories for necessity. - Automatic deletion of data no longer needed in accordance with defined retention periods. ### Pseudonymization - Where technically feasible and appropriate, personal data is processed in pseudonymized form. - Internal processing primarily uses UUIDs rather than real names. - Analytical evaluations are performed on an aggregated or pseudonymized basis. --- ## 10. Regular Review and Assessment - Regular security assessments of infrastructure and applications. - Dependencies are regularly checked for known vulnerabilities (dependency scanning). - Review and update of these TOMs at least annually or upon significant changes to processing activities. - Continuous improvement of security measures based on current threat landscape. --- ## 11. Additional Measures ### Input Control - Logging of changes to personal data (audit trail). - Traceability of who entered, modified, or deleted which data and when. ### Transfer Control - Data transfers are exclusively encrypted. - No transfer of personal data to third countries without an adequate level of protection (adequacy decision or Standard Contractual Clauses). ### Processing Control - Processing of personal data exclusively in accordance with the Controller's instructions. - Contractual regulation of commissioned processing in the DPA. ---_These technical and organizational measures are reviewed regularly and updated as necessary to ensure a level of protection consistent with the current state of the art._**Art of X UG (haftungsbeschränkt)** Managing Directors: Friedrich von Borries and Alexander Doudkin ## **Continue your procurement review** Use the buyer-facing checklist and evidence pages alongside these legal terms. [Minds](https://getminds.ai/)© 2026 Minds. Your target audience. AI-driven and grounded in transparent evidence. Build within minutes. [Minds on X (Twitter)](https://x.com/mindsai_co) [Minds on LinkedIn](https://www.linkedin.com/company/mindsaicompany/) [Minds on Instagram](https://www.instagram.com/getminds.ai/)Minds is part of [![ESOMAR](https://getminds.ai/images/newsroom/logos/esomar-logo.svg)ESOMAR](https://esomar.org/) [![GreenBook](https://getminds.ai/images/newsroom/logos/greenbook.svg)GreenBook Directory](https://greenbook.org/company/Minds) [![Insight Platforms](https://getminds.ai/images/newsroom/logos/insight-platforms.png)Insight Platforms](https://www.insightplatforms.com/platforms/minds/) [![Capterra](https://getminds.ai/images/newsroom/logos/capterra.svg)Capterra](https://www.capterra.com/p/10046203/Minds/) [![G2](https://getminds.ai/images/newsroom/logos/g2.svg)G2](https://www.g2.com/products/minds/reviews) [![CSSDA Best UX Design Award](https://getminds.ai/images/newsroom/logos/cssda-best-ux-award.png)CSSDA Best UX Design Award](https://www.cssdesignawards.com/) [![CSSDA Best Innovation Award](https://getminds.ai/images/newsroom/logos/cssda-best-innovation-award.png)CSSDA Best Innovation Award](https://www.cssdesignawards.com/) [![CSSDA Best UI Design Award](https://getminds.ai/images/newsroom/logos/cssda-best-ui-award.png)CSSDA Best UI Design Award](https://www.cssdesignawards.com/)