Security

Last updated November 12, 2026

How we protect your company's data:

• Separate vault per company. Each company's data is stored in its own database file, and every request is tied to one company's vault. Users of one company cannot see or reach another company's data.
• Encryption. All traffic uses HTTPS (TLS). Data is stored on encrypted disks at our hosting provider. Connection tokens for linked accounts are encrypted.
• Sign-in. Google sign-in or one-time email codes; no shared passwords. Sessions are signed and expire.
• Roles. Owners, office staff, technicians and tenants each see only what their role allows.
• Least privilege. Our staff access Customer Data only to provide support you request or to keep the Service secure.
• Backups. Disks are snapshotted daily and kept for 7 days.
• AI. AI providers may not train on your data.

Found a vulnerability? Please email legal@mymendly.app and give us a reasonable time to fix it before disclosure. Do not access other customers' data while testing.