a-to-mind

Docs Sample API Security Changelog Dashboard Checking status

Security

Security properties are product guarantees here, not documentation footnotes.

Data handling

• Secrets are stored encrypted and scoped per workspace; redacted from logs and ledger events.
• Tool arguments are stored as sanitized digests, never raw payloads containing credentials.
• Scoped, least-privilege credentials with explicit expiration for every integration.
• Retrieved content and tool output are treated as untrusted data — they cannot alter run policy.

Model providers

Run prompts and tool results are processed by the model providers configured for your workspace under your own API keys where possible. We do not sell or share your data with third parties for advertising. Specific provider data-retention terms apply per provider; see Privacy for details.

Responsible disclosure

Email security@a-to-mind.com. We acknowledge reports within 2 business days and will credit reporters who wish to be named.

Deletion

Deleting a workspace removes its runs, artifacts, ledgers, and credentials within 30 days, subject to legally required retention. Run exports remain yours.

This page describes our target architecture and commitments as of August 2026; material changes are announced in the changelog.