Security and compliance

Mudcor exists to protect sensitive data. That responsibility shapes how the product is designed, how it is operated, and how little of your information it ever holds. The controls below describe how we secure the service and your data.

Product architecture

The content your team types, pastes, or uploads is analyzed locally on the device and is never transmitted to Mudcor.

Data minimization

We collect only what is required to provide the service: workspace and account details, and privacy-preserving activity records.

Data Training

Mudcor does not use Customer Data to train, develop, or improve its own AI/ML models. Where third parties process Customer Data on Mudcor's behalf, they are subject to contractual restrictions prohibiting the use of such data to train, develop, or improve their models, except where expressly authorized by the customer.

Data protection

All data is encrypted in transit using modern TLS and encrypted at rest on enterprise-grade cloud infrastructure. Production data is logically separated.

Identity and Access Management

Mudcor applies the principle of least privilege to access to production systems, limiting access to authorized personnel based on defined roles and business requirements.

Change Management and Secure Development

Mudcor maintains a controlled software development and change management process designed to ensure that changes are appropriately validated before deployment to production. Production releases follow defined deployment gates and controlled rollout procedures. Mudcor maintains documented rollback procedures.

Security Assessment

Mudcor conducts ongoing security assessments of its product, including threat modeling and adversarial testing. Findings are triaged by severity and tracked to resolution.

Monitoring and incident response

Production systems are monitored continuously for availability, error rates, and anomalies, with alerting that pages the operations team. Incidents are triaged by severity, and every confirmed defect is tracked to resolution with a verifying test.

Business continuity

Customer data is backed up daily with encrypted, retained copies and documented recovery objectives. Recovery procedures are tested on a defined schedule.

Vendor and payment security

Payments are processed by a PCI DSS compliant payment provider. Card details are entered directly with the provider and never touch Mudcor systems.

Data governance

Customer Administrators can export their workspace data at any time and can delete their workspace, including member's data, on demand. Deletion is honored promptly. A data processing agreement is available on request.

Privacy by design

Mudcor is built around a privacy-preserving system. Our privacy practices are described in our privacy policy.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, contact security@mudcor.com and we will respond promptly.

Questions

Contact compliance@mudcor.com.