Security and Data Protection Policy

This policy applies to MentorU application code, production infrastructure, administrative access, tenant data, connected provider credentials, operational logs, backups, and third-party services used to deliver MentorU. Kahel Ventures LLC owns this policy and coordinates security, privacy, engineering, support, and incident decisions for MentorU.

• Access is authenticated and limited to the role and workspace needed for the requested action.
• Tenant-scoped operations resolve and bind the exact tenant on the server. A hostname, label, query parameter, or browser-supplied identifier is not authority.
• Customer OAuth consent is performed only by the recorded workspace owner. MentorU support may inspect safe status but cannot provide customer consent.
• Administrative and provider lifecycle actions produce secret-free audit evidence. Credentials, authorization codes, cookies, state values, and encryption keys are excluded.
• Production changes use reviewed source, affected validation, an immutable release candidate, staged smoke checks, and rollback readiness.

MentorU uses HTTPS for data in transit. OAuth access and refresh tokens are stored in authenticated AES-256-GCM envelopes bound to the tenant, provider, connection, and credential kind. Application secrets and encryption keys are held in restricted production configuration and are not committed to source control or returned to browsers.

For an exact embedded Zoom meeting, the authenticated browser may receive a short-lived Meeting SDK signature and a short-lived, user-associated ZAK issued only after exact tenant, session, meeting, and host authorization, or a meeting-bound OBF token for an entitled member join. MentorU does not persist or log those short-lived credentials.

• OAuth state is usable for no more than five minutes. The cross-host selection handoff is usable for no more than fifteen minutes. Sensitive transaction material is cleared after use, cancellation, terminal failure, or expiry.
• OAuth access and refresh tokens are retained only while the exact connection remains active. A confirmed disconnect, a valid provider deauthorization notice (Zoom, Meta, Threads), or a data deletion request sent through Meta or Threads disables the connection in every workspace that used the account and removes usable credentials from active storage immediately.
• A provider data deletion request is recorded as a one-way hash of the provider user identifier, a 128-bit confirmation code, the counts affected, and the time applied, never the raw identifier or a token. The record is append-only and is kept as evidence that the request was honored; its status page reveals only completion and date.
• A data deletion request from Meta or Threads also replaces the stored account, Page and Instagram identifiers and granted permissions on the scrubbed connections with non-identifying placeholders and removes Page tokens staged by unfinished connections.
• LinkedIn (commitment effective when that connection launches): connection identifiers and published post identifiers are kept with the connection. Other LinkedIn API data is not kept longer than 24 hours; displayed engagement figures are refreshed or deleted within 48 hours.
• YouTube uploads (commitment effective when that connection launches): stored YouTube API Services upload data is refreshed or deleted at least every 30 days; after a disconnect or Google revocation the OAuth tokens are removed immediately and remaining YouTube-derived upload data is deleted within 7 days.
• TikTok (commitment effective when that connection launches): connection identifiers and upload identifiers are kept with the connection; upload session addresses are secrets, never logged, and discarded when the upload completes or fails.
• Meeting SDK signatures, ZAK, and OBF are requested just in time, are not persistently stored by MentorU, and expire according to Zoom's short-lived credential rules.
• Zoom meeting metadata is retained with the corresponding workspace session while that session or workspace remains active. A mentor can delete the Zoom-backed meeting through MentorU. Covered active records associated with a verified deletion request or workspace closure are targeted for deletion or de-identification within 30 days unless an exception below applies.
• MentorU Live recordings are private MP4 objects authorized by exact workspace and occurrence. Playback and explicit download use short-lived signed access. Recordings expire and are deleted thirty days after finalization, or earlier when an authorized host or workspace admin deletes them. Secret-free tombstones retain the run, actor or system reason, deletion time, duration, size, and artifact digest but no media, object path, signed access URL, or credential.
• Secret-free provider lifecycle audit evidence is append-only and retained for the operating life of the MentorU service to preserve connection-history, replay, and tenant-boundary accountability. It contains no OAuth credentials, authorization codes, state, cookies, tokens, or secrets.
• Mentor Autopilot (commitment effective when Autopilot is turned on for a workspace): the record of each planned, sent, cancelled or blocked action is kept for 18 months; drafted message text is kept for 90 days after the message is sent or cancelled; consent, opt-out, import-attestation and send-metadata records (who, when, channel and consent basis; no message text) are kept for 5 years; a crisis or health category label is kept for no longer than 30 days after the mentor resolves the alert; coded do-not-contact keys (hashes of email addresses and phone numbers) are kept indefinitely so MentorU can keep honoring opt-outs, including after a deletion request; Gmail and Outlook send tokens and contact-import tokens are encrypted and removed on disconnect.

Retention may be extended when reasonably necessary for an active security investigation, fraud prevention, tax or accounting duty, dispute, litigation hold, or other legal requirement. Access remains restricted during the exception, and deletion resumes when the exception ends. Verified access or deletion requests may be sent to support@mentoru.app.

MentorU reviews production dependencies and security-sensitive code before release, monitors provider and package advisories, and records findings by severity and affected surface. Critical findings are targeted for triage within one business day and mitigation within 72 hours. High findings are targeted for triage within three business days and remediation within 14 calendar days. Moderate findings are targeted for remediation within 30 days and low findings within 90 days. A documented exception must identify the owner, exposure, compensating controls, and review date.

A known exploitable critical or high finding affecting the submitted application blocks release until remediated or explicitly contained and reviewed. Reports may be sent to support@mentoru.app with “Security report” in the subject. Do not include live secrets or personal data that is not needed to explain the issue.

MentorU's incident process covers detection, validation, severity assignment, containment, evidence preservation, eradication, recovery, monitoring, required notification, and a post-incident review. Kahel Ventures coordinates the response and engages affected infrastructure or provider teams when necessary. Access may be disabled, credentials revoked or rotated, effects denied, or a release rolled back to contain risk.

Confirmed incidents are documented without placing credentials or unnecessary customer content in the incident record. MentorU notifies affected parties and authorities when required by applicable law, contract, or provider rules. Critical unauthorized-access reports are acknowledged within one business day during the published support schedule.

• MentorU uses Vercel for application hosting and Supabase for authentication and PostgreSQL. Zoom, Stripe, Resend, and the social and video providers a workspace connects (Meta, Threads, LinkedIn, TikTok, YouTube) are used only for the connected capabilities described to users.
• Production identities, environment configuration, domains, migrations, dependency locks, and rollback targets are verified before release.
• Dependencies are pinned or lockfile-resolved, reviewed for advisories, updated through a tested candidate, and replaced before end of support when they remain in a sensitive path.
• Provider access is limited to the data and permissions required for the enabled feature. Provider connection never by itself authorizes an external send, meeting, charge, publish, or other effect.
• Infrastructure providers are evaluated for security, availability, confidentiality, and data-protection terms appropriate to the data they process. Access is removed when a provider is no longer required.

MentorU uses immutable application candidates, staged smoke checks, and a verified application rollback target. Recovery work must preserve tenant boundaries and must not intentionally restore revoked provider credentials or deleted data to active use. Material incidents receive a post-recovery review and follow-up actions.

Infrastructure providers may maintain restricted recovery copies under their own contracted service and current configuration. MentorU does not publish a fixed backup-retention window without current provider evidence. If recovery reintroduces data covered by an outstanding deletion obligation, that obligation must be re-applied before normal use resumes.

This policy records MentorU's security and data-protection commitments effective August 15, 2026. It does not claim historical completion of every recurring review or exercise. MentorU does not claim SOC 2 or ISO certification, a formal SAST/DAST program, or an independent third-party penetration test unless a current report explicitly says otherwise. No internet service can guarantee absolute security.

Send security, privacy, or data-protection questions to support@mentoru.app.