Security and data protection

The short version

• The app and database run in Germany. Files are stored in the EU, with video playback over a worldwide network. Switch on Store in Germany and a project’s review files and videos stay in Germany.
• All connections are encrypted, and review links can have a password, an expiry date and an email code.
• A data processing agreement is included, and we have an external data protection officer.
• No analytics, no advertising, and your content does not train AI models.

Where your data is

Store in Germany applies to new uploads. What was stored before it was switched on stays where it is.

Want files to stay off our systems altogether? You can add a file by link from your own storage. We then keep only the link, encrypted. Everyone reviewing it needs to be able to reach that storage. The full list of providers is on the subprocessor page.

Protection in the service

• Encryption. All connections use TLS with HSTS. Files on Cloudflare R2 are encrypted at rest with AES-256. Sensitive fields such as external file links are also encrypted by the app with AES-256-GCM.
• Sign-in. Passwords are stored only as salted scrypt hashes. Sessions are held on the server and can be revoked. Rate limits and capped attempts protect sign-in and one-time codes.
• Roles. Owner, admin, manager and editor, checked on the server for every request.
• File access. Files are delivered through short-lived signed links.
• Uploaded code stays apart. HTML courses and reviewed websites run on separate addresses in sandboxed frames, so they cannot reach your Wunderblick session.
• Server. The database is reachable only from inside the server, and the app runs as a non-root user.
• Code. We review the full code base for security issues, most recently in July 2026.

Control over review links

• Separate links and comments per audience, for example team, client and legal.
• Password, expiry date, revocation and download permission per link.
• Reviewers confirm their email with a 6-digit code. On open links a name is enough, but they cannot approve until they verify.
• Internal comments are never shown to external reviewers.

Backups

The database is backed up every night and before every software update, with an integrity check. Backups stay in the EU for 30 days. Earlier software versions are kept so we can roll back quickly.

Data centres

Hetzner holds ISO/IEC 27001 certification for its data centres. Cloudflare holds ISO/IEC 27001 and SOC 2 Type II. We keep no customer data on our own premises.

AI and your data

Voice comments, translation and AI briefs are optional and start only when someone uses them. Your content does not train AI models. Voice audio goes to AssemblyAI’s EU servers, translation uses Google’s paid Gemini API, and AI briefs have personal data removed before you share them with a tool of your choice.

GDPR

• Roles. You are the controller of the data in your workspace, and we are your processor.
• Contract. Our data processing agreement under Art. 28 GDPR is included in the terms, and it lists our security measures.
• Subprocessors. Listed openly, with 30 days’ notice of changes.
• Data protection officer. Dominik Fünkner, PROLIANCE GmbH, dsb@datenschutzexperte.de.
• Your data. Read our privacy policy to see how we handle account data and how to use your rights.

EU Data Act

You can export your data and switch provider at any time, with no switching fees. See section 9 of the terms.

Mynd GmbH is subject to German and EU law. Our servers are in Germany and our stored files in the EU. Cloudflare, Resend, AssemblyAI and Polar are US companies, and Google’s parent company is too, so they are also subject to US law. To guard against unlawful access by foreign authorities to data held in the EU, we use encrypted connections, storage in the EU, a Germany-only option and contracts with each provider. We hand over data only when legally bound to do so, challenge requests we consider unlawful, and tell you unless the law forbids it.

Report a vulnerability

Found a security problem? Please email beratung@mynd.com with the subject “Security” before sharing it publicly. We will look into it promptly.