Trust
Trust Center
What is true about Mondaily's security and privacy today, with links to the evidence, and what is still in progress.
Last checked: 8 November 2026. This page is in English for now. A translation is coming.
True today
Stored and processed in Frankfurt, Germany
Mondaily's database and files, the app and its API, and the machines we run are in Frankfurt, Germany (EU). A few outside services choose their own region; the data location page lists every place, part by part.
Encrypted backups in two countries
Every night an encrypted copy of the database is saved in Frankfurt. A second copy is encrypted on our own machine before it leaves, then kept in a Swiss cloud, which cannot read it without our key. We restored both copies in a test on 2 November 2026.
AI runs in Frankfurt
Today chat is answered by our rules engine in Frankfurt; our own AI engine there is not switched on for customers yet. A customer's own AI key (Claude, OpenAI, Gemini or Mistral) is used only if an owner of the workspace adds one. No outside AI company receives your chats otherwise.
Our own mail server
Mondaily's email goes out through our own mail server in Frankfurt, which hands each message to Amazon SES there. Mail to our addresses arrives on that same server. Only when our server cannot take a message does a backup sender deliver it.
You approve before anything goes out
Agents prepare the work and a person approves it. A post goes out only after someone confirms that exact post, a message draft a model wrote stays marked as an AI draft until you edit it, and risky actions pass a verify first check before they run.
Connection tokens encrypted by us
When you connect a mailbox, accounting software or another service, its sign in tokens and mailbox credentials are encrypted by us with AES-256-GCM, bound to their owner, on top of the database's own encryption.
Two step sign in and passkeys
Every account can turn on two step sign in with an authenticator app (with recovery codes) and add passkeys. Passwords are stored only as scrypt hashes, and you can see your sessions and sign out everywhere.
Told when it is an AI
People are told when they deal with an AI:
- chat in the app carries an AI label and the note that AI can make mistakes;
- everyone in a call, guests included, sees when AI is taking notes;
- a message draft written by AI is marked as an AI draft until you edit it;
- an image marked as AI made shows "Image: AI-generated".
How long we keep data
Each kind of data has a set period:
- a deleted account or workspace: 14 days to change your mind, then erased;
- a password account never verified: erased 14 days after sign up;
- contact form messages: 2 years;
- raw website analytics: 90 days;
- the nightly backup: 30 days per copy, the Swiss copy 35 days;
- invoices and tax records: 6 years, as UK company and VAT law require.
Export and delete your data
Export any list as CSV, download reports as Excel, PDF or HTML, or read your workspace through the API with your own key. You can delete your account at any time: after a 14 day restore window it is erased, and the erase is logged. Requests by email go to privacy@mondaily.com.
Every outside provider listed
The Subprocessors page lists every outside provider that handles personal data for Mondaily: what it does, the data it receives, where, and when it is used.
Report a security issue
Write to security@mondaily.com. We fix a critical issue within 48 hours and a high one within 14 days.
In progress
As of 8 November 2026. Work that is not finished yet; nothing here is presented as done.
- CSA STAR Level 1 self-assessment: in preparation
- SOC 2 and ISO 27001: in progress, target date to be set
- Cyber Essentials (UK): after company registration
Policies available on request
Business customers can ask for Mondaily's security and privacy policies and our answers to the CSA security questionnaire (CAIQ). We share them under a non disclosure agreement. Use the contact form and say which documents you need.
Mondaily is provided by Mondaily Ltd (placeholder: the company is being registered in the United Kingdom). Company number: to be added after registration in England and Wales. Registered address: to be added after registration.