Trust

Security

Last updated: 9 November 2026. This page describes how Mondaily protects your data and where it goes. Mondaily itself holds no security certification. Our application hosting and database are provided by Vercel and Supabase, each of which states that it holds a SOC 2 Type 2 attestation and ISO 27001 certification; those are their certifications, not ours. What we do gives you evidence for your own GDPR, UK GDPR and US state privacy work; it does not by itself show that any law is met.

Sovereign-first AI architecture

Mondaily is built on a sovereign-first AI architecture. Today chat is answered by our rules engine in Frankfurt; our own AI engine there is not switched on for customers yet. Your data goes to an outside AI provider only if your workspace connects its own AI key (masked, under your own agreement with that provider). The application is hosted in Europe, and your data is workspace-isolated: every AI request is scoped to your workspace and can't read another's.

  • Source-backed AI answers, with human-approved agent actions: agents prepare, you approve
  • No fallback to third-party AI providers, ever; an owner can lock the workspace so no outside AI provider is ever allowed; your data isn't used for training unless you explicitly approve it
  • Google (Gmail and Google Calendar) is an optional, client-authorized integration: email and calendar data is accessed only after you connect an account, stays workspace-scoped, and can be disconnected any time; it is not core AI infrastructure
  • Stripe is our payment processor: card numbers live with Stripe, never stored by Mondaily, and are never accessible to AI tools

Your privacy rights (EU, UK and elsewhere)

How we handle personal data under the EU and UK GDPR, and the similar laws of other countries, is set out in the Privacy Policy. In short:

  • A stated legal basis for each use of your data
  • Account and data deletion on request, after a 14-day window to change your mind
  • Data portability: export your records at any time
  • A Data Processing Agreement for every business customer: see the DPA page
  • The right to complain to a data protection authority, such as the ICO in the UK

If you live in the US

Mondaily does not sell personal information and does not share it for cross-context behavioural advertising. Under the California Consumer Privacy Act and similar state laws you have the right to:

  • Know what personal data we hold about you, and get a copy
  • Correct or delete your personal data
  • Opt out of sale and sharing (we do neither); Global Privacy Control is honoured
  • Appeal if we turn a request down

Hosting infrastructure & sub-processors

These third parties process customer data on Mondaily's behalf. What each one receives and when it is used is on our DPA page; both pages are drawn from the same list.

No AI vendor processes your data for Mondaily. sōtem (AI), web scraping, transcription and embeddings are built to run only on servers Mondaily operates. Until those servers are in service, these features are not available; it never falls back to a third party. The Prospecting Agent looks businesses up in the public data sources listed below, sending them search words only.

Your own AI key: if your workspace chooses to connect its own key for a hosted AI provider, sōtem sends masked chat text and tool results to the provider you chose, under your own agreement with that provider. That provider is not a Mondaily sub-processor; only an owner or admin can turn this on, and an owner can lock it off.

Your own business tools: if an owner or admin connects your workspace's HubSpot account, Mondaily reads your contacts, companies, deals and owner names from it into your workspace. It changes a HubSpot record only when a person in your workspace approves that exact change in the Decision Queue, and then sends only the approved values for that record; it never overwrites a value someone changed in HubSpot since the last sync. If an owner or admin connects your Xero or QuickBooks Online books, Mondaily reads your invoices, payments, bills, expenses, customers and suppliers from them and never changes anything there. Each of these is your own tool, used under your own agreement with its provider; it is not a Mondaily sub-processor. Disconnecting stops the reading and gives up Mondaily's access.

Core platform: hosted in the EU (Frankfurt)

Mondaily runs the application and stores your data in the EU (Frankfurt), on infrastructure from these two providers.

  • Vercel: Hosting for the web app, the API and this website.

    Where: EU: the API runs in Frankfurt (fra1); public web pages are cached on Vercel's global edge network.

  • Supabase: Database and file storage, including call recordings.

    Where: EU: Frankfurt.

  • Amazon Web Services (machines Mondaily runs): Our operations machine (incoming mail, outgoing mail through Amazon SES, our own web search and search memory), the nightly database backup (Amazon S3) and our own AI engine.

    Where: EU: Frankfurt, Germany (AWS eu-central-1).

  • Infomaniak (Swiss Backup): A second, encrypted copy of the nightly database backup.

    Where: Switzerland (outside the EU, with an EU adequacy decision).

Temporary providers (planned to be replaced)

We plan to replace each of these with a service Mondaily runs itself. Until then they are in use as described here. When we switch, we run ours in parallel first, switch over, then turn theirs off.

  • Inngest (Inngest Cloud): Runs background jobs: scheduled agents, record enrichment, reminders.

    Where: Inngest's cloud; region set by the provider, may be outside the EU.

    Plan: Our own job runner on a Mondaily server (a configuration switch, run in parallel first).

  • Resend: Backup delivery of account and notification email, and email your workspace sends.

    Where: Resend's cloud; region set by the provider, may be outside the EU.

    Plan: Our own mail server already sends first (since 7 November 2026); Resend stays as the fallback while its reputation builds, then is removed.

  • Amazon Web Services (AWS Lambda): Opens your proven website in a real browser for yof's website check (read-only: it loads pages, it never submits a form or signs in).

    Where: Frankfurt, Germany (AWS region eu-central-1, where our stack is deployed).

    Plan: The same browser code on a server Mondaily runs itself.

  • LiveKit (LiveKit Cloud): Real-time audio and video for calls; records a call when someone in it starts recording.

    Where: LiveKit's cloud: calls connect through servers near the participants, and LiveKit keeps the call records for our project in the United States.

    Plan: Our own LiveKit and TURN servers in Europe, after launch.

Optional: only when you choose it

Nothing is sent unless you sign in with or connect the account yourself; you can disconnect at any time.

  • sōtem Studio engine (run by Mondaily, not a third party): Text to speech, speech to text and the other sōtem Studio models, run by Mondaily, no outside AI provider.

    Where: Not in use yet: no voice data is processed here today. Its location is listed here before any is.

  • Google (Sign in with Google, Gmail, Google Calendar): Optional sign-in with Google, and the optional Gmail and Google Calendar connector.

    Where: Google's cloud; region set by the provider.

  • Microsoft (Sign in with Microsoft, Outlook mail and calendar): Optional sign-in with a Microsoft account, and the optional Outlook mail and calendar connector.

    Where: Microsoft's cloud; region set by the provider.

  • LinkedIn: Optional LinkedIn connection: sign in with your own LinkedIn account and publish posts you approve.

    Where: LinkedIn's cloud; region set by the provider.

  • X: Optional X connection for Social: publish posts you approve.

    Where: X's cloud; region set by the provider.

  • Meta (Facebook, Instagram, Threads): Optional Facebook Page, Instagram and Threads connections for Social: publish posts you approve.

    Where: Meta (Facebook, Instagram, Threads)'s cloud; region set by the provider.

  • TikTok: Optional TikTok connection for Social: publish videos and photos you approve.

    Where: TikTok's cloud; region set by the provider.

  • Google (YouTube, Business Profile): Optional YouTube and Google Business Profile connections for Social: publish uploads and updates you approve.

    Where: Google (YouTube, Business Profile)'s cloud; region set by the provider.

  • Pinterest: Optional Pinterest connection for Social: publish pins you approve.

    Where: Pinterest's cloud; region set by the provider.

  • Telegram: Optional Telegram channel connection for Social: publish posts you approve through Mondaily's bot.

    Where: Telegram's cloud; region set by the provider.

  • Bluesky: Optional Bluesky connection for Social: publish posts you approve.

    Where: Bluesky's cloud; region set by the provider.

  • Mastodon (your chosen server): Optional Mastodon connection for Social: publish posts you approve on the server you choose.

    Where: Mastodon (your chosen server)'s cloud; region set by the provider.

  • Snapchat: Optional Snapchat connection for Social (only after Snap grants partner access): publish stories you approve.

    Where: Snapchat's cloud; region set by the provider.

  • PayPal: sōtem Data Lab: paying contributors for approved work.

    Where: PayPal's cloud; region set by the provider.

Payments: Stripe, we never see or store card numbers

Used only when you buy something.

  • Stripe: Payment processing.

    Where: Stripe's cloud; region set by the provider.

Public data sources (the Prospecting Agent)

The Prospecting Agent in sōtem Team finds companies in public, openly licensed data and checks each one in official registers. These services are not sub-processors: they receive only search words (an industry, a city or country, a date range, a company's public job board name) or a found company's public name, legal number or website domain, never your records, contacts or any personal data. We show each source's credit next to the results it gave.

  • The companies' own websites

    Receives: A request for a public page of a company that our web search found (its robots.txt is read first, and a site that says no is not read).

    We take: Only what the company publishes about itself: its name, industry, address, phone and business email, each with the page it came from.

    Licence: Public pages, read under each site's robots.txt (RFC 9309); the content stays the company's own. Terms

  • TED, the EU's public tenders journal

    Receives: A procurement category code, a country and a date range.

    We take: Open calls for tender: buyer, title, dates and the notice link.

    Licence: EU open data, free reuse with credit (Commission Decision 2011/833/EU); credit: Source: TED. Terms

  • GDELT news index

    Receives: Industry and place words.

    We take: Links, headlines and dates of public news about funding or expansion.

    Licence: Free reuse with citation; credit: News index: The GDELT Project. Terms

  • Wikidata

    Receives: A country, or an industry and a city.

    We take: Organisation names and their official websites.

    Licence: CC0 1.0 (public domain); credit: Data from Wikidata. Terms

  • Greenhouse and Lever public job boards

    Receives: The public job board name a company links from its own careers page.

    We take: Open role titles, locations and links the company published.

    Licence: Public job-board APIs, no account needed; the company's own published postings. Terms

  • Official company registers (UK, France, Norway, Denmark, Poland, US) and GLEIF

    Receives: A found company's public name and town, or the legal number it publishes on its own site (company number, SIREN, org number, CVR, KRS, NIP, LEI).

    We take: Whether it is active, its legal form, registered address, industry code and named officers. Companies that opted out of marketing in their register (France, Denmark) are never used.

    Licence: Companies House and Contracts Finder: Open Government Licence v3.0; SIRENE: Licence Ouverte 2.0; Brønnøysund: NLOD 2.0; CVR and KRS / CEIDG: their public register terms; SEC EDGAR: US public domain; GLEIF: CC0 1.0. Terms

  • Public contract awards and certificate logs

    Receives: A found company's public name (TED, UK Contracts Finder, SAM.gov) or its website domain (crt.sh).

    We take: Public contracts the company won, and the date its domain got its first certificate (a new website), each with its link and date.

    Licence: TED: EU open data with credit; Contracts Finder: Open Government Licence v3.0; SAM.gov: US public domain; Certificate Transparency: public log data. Terms

  • Common Crawl

    Receives: A found company's own website domain.

    We take: A few archived pages of that company's own site, read only for the contact details it published itself, dated by the crawl.

    Licence: Common Crawl Terms of Use; the page content stays the company's own. Terms

  • Brave Search (only if switched on)

    Receives: Search words, with private details (emails, phone numbers, ids, bank and card numbers) removed first; when enriching a company record, that company's name. Never people's names. Used as the backup for the Prospecting Agent, sōtem chat web search and research, and record enrichment, only while Mondaily's own web search is not available and the workspace allows it.

    We take: Links to public web pages; we keep none of its results. Brave keeps query logs for up to 90 days (its API privacy notice: https://api-dashboard.search.brave.com/privacy-policy).

    Licence: Brave Search API terms. Terms

This page is the current list. We add a provider here before it receives any customer data, and the "Last updated" date changes with every change. Customers with a signed DPA can ask privacy@mondaily.com for the list at any time.

For the current status of Vercel's and Supabase's certifications, see vercel.com/security and supabase.com/security.

Zgłoś problem z bezpieczeństwem

Znalazłeś problem z bezpieczeństwem w Mondaily? Powiedz nam o tym prywatnie. Człowiek odpowie w ciągu 3 dni roboczych i będzie Cię informować aż do naprawy.

Napisz na security@mondaily.com.

Napisz, co znalazłeś, gdzie, jak to odtworzyć i co atakujący mógłby z tym zrobić. Prosimy nie publikować problemu z bezpieczeństwem.

Pełne zasady, z tym co obejmują, czego nie obejmują i jak szybko odpowiadamy: Zasady zgłaszania podatności.

Nasz plik kontaktowy do odczytu maszynowego jest pod adresem www.mondaily.com/.well-known/security.txt.

Questions

For security or compliance questions, including data deletion requests, contact privacy@mondaily.com.

Security · Mondaily