Mindsetor

Trust and security

The facts, including what we do not have yet.

This page is written for your privacy officer. Test us against the documents at the bottom.

Reporting

Storage and processing

In the EU, encrypted.

  • Location. Data is stored and processed in the EU (Google Cloud, Belgium region).
  • Encryption. Encrypted at rest and in transit.
  • Infrastructure. Our infrastructure runs on Google Cloud, which holds ISO 27001 and SOC 2 certifications, among others. Those certificates belong to Google Cloud, not to Mindsetor.
  • Medical confidentiality. Psychologists’ session notes fall under Dutch medical confidentiality law (Wkkgz). The employer never sees who books a session.

Where we stand

Not yet certified. Independently tested.

  • Certification. Mindsetor itself is not yet ISO 27001 or SOC 2 certified. Evidence collection has been running since April 2026; certification follows when the company’s scale justifies it.
  • Penetration test. External test by MaaSec, February 2026: 18 findings, remediation in progress. The test repeats annually.
  • DPIA. The published DPIA covers the app. The extension for the screening is in preparation.

Boundary

Not a medical device.

Mindsetor does not diagnose, does not predict conditions and does not treat. The WHO classifies burnout as an occupational phenomenon, not a medical condition (ICD-11, QD85). We recognise and flag workload at group level and connect employees to care. Source

Documents

The documents.