Security and data protection

Where your data is

What Store in Germany covers. It keeps a project’s new files, videos and comment attachments in Germany from the moment it’s switched on. It doesn’t move anything uploaded earlier: to bring a file over, upload it again and delete the old version. It’s about where files are stored, so other parts of the service stay as the table shows. Comments and project details are in the database in Germany, with backups in the EU. Service emails go through the USA and name the file and project, though in these projects they don’t quote comments. Translation, if someone uses it, goes to Google. AI briefs are off in these projects unless a project manager turns them on.

Want files to stay off our systems altogether? You can add a file by link from your own storage. We then keep only the link, encrypted. Everyone reviewing it needs to be able to reach that storage. The full list of providers is on the subprocessor page.

Protection in the service

• Encryption. All connections use TLS with HSTS. Files on Cloudflare R2 are encrypted at rest with AES-256. Sensitive fields such as external file links are also encrypted by the app with AES-256-GCM.
• Sign-in. Passwords are stored only as salted scrypt hashes. Sessions are held on the server and can be revoked. Rate limits and capped attempts protect sign-in and one-time codes.
• Roles. Owner, admin, manager and editor, checked on the server for every request.
• File access. Files are delivered through short-lived signed links.
• Uploaded code stays apart. HTML courses and reviewed websites run on separate addresses in sandboxed frames. They can’t read your Wunderblick pages or session, and requests they send to the app are refused. A course’s own page could still show something misleading, such as a fake login form, so sign in only on app.wunderblick.com.
• Server. The database is reachable only from inside the server, and the app runs as a non-root user.
• Code. We review the full code base for security issues ourselves, most recently in November 2026. It hasn’t had an external audit or penetration test yet.

Control over review links

• Separate links and comments per audience, for example team, client and legal.
• Password, expiry date, revocation and download permission per link.
• Reviewers confirm their email with a 6-digit code. On open links a name is enough, but they cannot approve until they verify.
• Internal comments are never shown to external reviewers.

Backups

The database is backed up every night and before every software update, with an integrity check. Backups stay in the EU for 30 days. Earlier software versions are kept so we can roll back quickly.

Data centres

Hetzner holds ISO/IEC 27001 certification for its data centres. Cloudflare holds ISO/IEC 27001 and SOC 2 Type II. We keep no customer data on our own premises.

AI and your data

Voice comments, translation and AI briefs are optional and start only when someone uses them. We don’t train AI models on your content. Voice audio goes to AssemblyAI’s EU servers. Translation uses Google’s paid Gemini API, which keeps the text for up to 55 days to detect abuse. An AI brief replaces the names, emails and phone numbers it finds in comment text before you share it with a tool of your choice. It doesn’t change screenshots, quoted document text or the file name, so please check it first. Our privacy policy has the details.

GDPR

• Roles. You are the controller of the data in your workspace, and we are your processor.
• Contract. Our data processing agreement under Art. 28 GDPR is included in the terms, and it lists our security measures.
• Subprocessors. Listed openly, with 30 days’ notice of changes.
• Data protection officer. Dominik Fünkner, PROLIANCE GmbH, dsb@datenschutzexperte.de.
• Your data. Read our privacy policy to see how we handle account data and how to use your rights.

EU Data Act

You can export your data and switch provider at any time, with no switching fees. Our data export register describes what you get and in what format, and section 9 of the terms sets out how switching works.

Jurisdiction and international access (Art. 28 Data Act)

Mynd GmbH is subject to German and EU law. Our servers are in Germany and our stored files in the EU. Cloudflare, Resend, AssemblyAI and Polar are US companies, and Google’s parent company is too, so they are also subject to US law. To guard against unlawful access by foreign authorities to data held in the EU, we use encrypted connections, storage in the EU, a Germany-only option and contracts with each provider. We hand over data only when legally bound to do so, challenge requests we consider unlawful, and tell you unless the law forbids it.

Report a vulnerability

Found a security problem? Please email beratung@mynd.com with the subject “Security” before sharing it publicly. We will look into it promptly.