Mindsetor

Trust and security

The facts, including what we do not have yet.

This page is written for your privacy officer. Test us against the documents at the bottom.

Reporting
  • Individual answers go to the employee. Never the employer.
  • Groups of 15 or more. Never an individual.
  • Voluntary.
Storage and processing

In the EU, encrypted.

  • Location. Data is stored and processed in the EU (Google Cloud, Belgium region).
  • Encryption. Encrypted at rest and in transit.
  • Infrastructure. Our infrastructure runs on Google Cloud, which holds ISO 27001 and SOC 2 certifications, among others. Those certificates belong to Google Cloud, not to Mindsetor.
  • Medical confidentiality. Psychologists’ session notes fall under Dutch medical confidentiality law (Wkkgz). The employer never sees who books a session.
Where we stand

Not yet certified. Independently tested.

  • Certification. Mindsetor itself is not yet ISO 27001 or SOC 2 certified. Evidence collection has been running since April 2026; certification follows when the company’s scale justifies it.
  • Penetration test. External test by MaaSec, February 2026: 18 findings, remediation in progress. The test repeats annually.
  • DPIA. The published DPIA covers the app. The extension for the screening is in preparation.
Boundary

Not a medical device.

Mindsetor does not diagnose, does not predict conditions and does not treat. The WHO classifies burnout as an occupational phenomenon, not a medical condition (ICD-11, QD85). We recognise and flag workload at group level and connect employees to care. Source

Documents

The documents.