Security & privacy
Private by design.
MONDAi holds real businesses — offers, brand assets, credentials, conversations. It's built like that matters, because it does.
Invite-only access
There is no self-serve signup. Every account is created by the Calibrated Ascension team, and a login that isn't provisioned for the platform is refused — authentication alone is not enough.
Your data is isolated
Access control is enforced at the database row level, per tenant. Clients see their own workspace and nothing else; team members see only the clients they're assigned to. The same rules apply to every surface — there is no privileged side door in the UI.
Credentials live in an encrypted vault
Domain, email, and integration credentials your build needs are stored encrypted and access-controlled — never in chat, never in plain text, never shared beyond the people working on your account.
You own your work
Your offers, copy, pages, and assets are yours. At handoff you receive full access, and you can request an export or deletion of your data at any time — see the privacy policy for the specifics.
Infrastructure
- Data is encrypted in transit (TLS) and at rest, hosted on Supabase and Vercel.
- Sessions use modern OAuth / PKCE flows; passwords are never stored by us in readable form.
- Security headers, strict framing rules, and audit logging protect the application surface.
- AI agents operate on your project's own data under the same access rules — your information is never used to train models.
Questions
Security questions or disclosures: support@mondai.io. We respond to security reports with priority.