MergeMind does not currently hold SOC 2, ISO 27001 or any third-party security certification. The controls below are implemented in the running platform; formal certification is on the roadmap and prioritised by real enterprise demand. If a certification is a hard requirement for your evaluation, tell us in a Build Review — it shapes what we prioritise next.
Implemented today, checked against the code
Authentication & access control
Zero-Trust gateway
A single gateway validates the JWT once, then signs and injects identity headers (HMAC + timestamp). Downstream services verify the signature — they never parse a JWT themselves.
Multi-factor authentication
TOTP-based MFA with backup codes, alongside SSO and invite-based provisioning.
Token security
JTI blacklisting, one-time refresh-token rotation and bulk session revocation.
RBAC + ABAC authorization
50+ fine-grained permissions across 4 platform roles, plus an attribute/ownership policy engine (owner-only, roles, time and IP ranges, deny-overrides).
SSO / SAML for enterprise
Per-tenant identity-provider setup, with signed-assertion checks for wrapping, audience, issuer, recipient and replay. Hardened and tested in July 2026; not yet verified with a customer’s own identity provider.
SCIM 2.0 provisioning
Automatic user provisioning from an identity provider, authenticated by a per-tenant bearer token. Users can be created, read, updated, deleted and listed, and that route is live through the gateway. Still missing: PATCH, Groups, automated tests, and a gateway route for creating the bearer token an identity provider needs.
Tenant isolation
Tenant context from a verified header only
The tenant a request operates on is resolved from the gateway-signed header, never from a client-supplied body field — so a tenant ID can’t be spoofed by the caller.
Enforcement at the data layer
Every service scopes reads and writes to the caller’s tenant at the data-access layer — enforced, not left to per-endpoint convention.
Scheduled data purge
Tenant offboarding includes a scheduled data-purge path for GDPR-style deletion requests.
Dedicated / VPC / self-hosted deployment
Full infrastructure isolation for a single tenant, scoped and quoted individually as a Dedicated Enterprise engagement.
Data protection
Encryption in transit
All traffic to the platform is served over HTTPS/TLS.
Payment data
Card and payment details are handled by our PCI-compliant payment processors (Razorpay, Stripe) — MergeMind does not store raw card data.
Published data-residency options
A formal published policy on where tenant data is stored, with regional options, is not live yet — available on request for engaged prospects today.
Published backup & disaster-recovery runbook
Backups exist operationally; a formal, externally published RPO/RTO commitment is on the roadmap.
Audit & observability
Transactional outbox to an immutable audit trail
Domain writes emit through a transactional outbox to Kafka, so an event is never published unless its transaction committed — feeding a searchable, immutable audit store.
Distributed tracing & metrics
Request tracing (Jaeger), metrics (Prometheus/Grafana) and structured logs on every service — not just uptime pings.
Per-tenant audit export
Self-serve export of a tenant’s own audit history via the console is planned; available on request today.
Certifications & formal programs
SOC 2 Type I / II
ISO 27001
Formal subprocessor list & DPA template
Published vulnerability disclosure program
Found a security issue?
We don't yet have a formal bug-bounty program, but we take reports seriously and respond fast. Email hello@mergemind.co with details — please don't open a public issue or post the finding publicly before we've had a chance to respond.