What we store, and how
If our database leaked, it should reveal as little as possible about anyone. Mendloop needs to know that 1,840 users hit a crash, not who they are.
| Data | Stored as | Notes |
|---|---|---|
| End-user IDs, emails, device IDs | Keyed hash, HMAC-SHA256 with a per-organization secret | Counts unique users and links events. It can’t be reversed or matched across organizations. |
| IP addresses | Keyed hash; country kept if you want it | Never stored raw. |
| Messages, breadcrumbs, request bodies | Scrubbed at ingest, then stored | Emails, phone numbers, cards, tokens, JWTs, keys and IPs are removed. Add your own rules. |
| Screenshots and session replay | Inputs masked in the SDK, stored encrypted | Off by default, short retention. |
| Raw event payloads | Kept for the retention window | 30 days by default, then deleted. Issues keep aggregates and the evidence cited in a root cause. |
| Customer data from your CRM | Not stored | Fetched when needed and cached for 10 minutes. Issues keep a hashed account reference. |
| Your team’s emails | Encrypted, plus a hash for sign-in lookup | Needed to sign in and to notify. |
| Passwords | argon2id hash | Or no password at all, with SSO or a magic link. |
| Integration tokens and vault secrets | Envelope encryption, AES-256-GCM | Data keys wrapped by a per-organization key. Never logged, never sent to a model. |
| API keys | Hash only | Shown in full once, at creation; after that only the prefix. |
| Your code | Never in the database | Repository mirrors live on disk; sandboxes are destroyed after each run. Snippets cited in a root cause stay with its report. |
| Prompts and model outputs | Stored after redaction | So you can audit exactly what was sent to a provider. |
Write access, just in time
Every connection starts read-only. Write access is a separate grant, requested the first time a workflow needs it, and only an Admin can give it.
- Per fixAfter an approval, a short-lived token is issued for one branch, such as
fix/MOB-123-checkout-npe. Mendloop never pushes to your main branch. - Two approvalsPolicies can require two approvals for sensitive code, such as payments or sign-in.
- StopOne switch stops every write at once; another stops a single workflow.
- On recordEvery decision is in the audit log with who made it and from where: the app, Slack, Teams, email or a phone.
Secrets never reach a model
Before every model call, secrets are replaced with {{secrets.*}} placeholders and personal data with tokens like <email_1>.
Evidence is wrapped in tagged blocks marked as data, not instructions, so text inside a log line can’t steer the agent. Prompts are stored after redaction. A local-only switch blocks every external provider, and each provider’s data policy is shown where you add its key.
Behind the walls
Mechanisms that hold even if one layer fails.
Or keep it all at home
Self-host Mendloop and nothing leaves your network unless you choose it.
It needs only Postgres and Redis. Run local models with Ollama or vLLM, reach private Git through an outbound-only relay, and no telemetry is sent unless you opt in.
“Kintsugi”, a jar mended with gold. Photograph by Guggger, CC BY-SA 4.0.
Found a flaw?
Email security@getmendloop.com with the steps to reproduce it. Please don’t open a public issue.
- 2 working daysto reply to your report, and we keep you posted until it is fixed.
- In good faithWe won’t take action against research that avoids privacy violations, data destruction and service disruption.
- CreditWe name you in the release notes if you want us to.