Security and Data Protection Policy

This policy applies to MentorU application code, production infrastructure, administrative access, tenant data, connected provider credentials, operational logs, backups, and third-party services used to deliver MentorU. Kahel Ventures LLC owns this policy and coordinates security, privacy, engineering, support, and incident decisions for MentorU.

• Access is authenticated and limited to the role and workspace needed for the requested action.
• Tenant-scoped operations resolve and bind the exact tenant on the server. A hostname, label, query parameter, or browser-supplied identifier is not authority.
• Customer OAuth consent is performed only by the recorded workspace owner. MentorU support may inspect safe status but cannot provide customer consent.
• Administrative and provider lifecycle actions produce secret-free audit evidence. Credentials, authorization codes, cookies, state values, and encryption keys are excluded.
• Production changes use reviewed source, affected validation, an immutable release candidate, staged smoke checks, and rollback readiness.

MentorU uses HTTPS for data in transit. OAuth access and refresh tokens are stored in authenticated AES-256-GCM envelopes bound to the tenant, provider, connection, and credential kind. Application secrets and encryption keys are held in restricted production configuration and are not committed to source control or returned to browsers.

For an exact embedded Zoom meeting, the authenticated browser may receive a short-lived Meeting SDK signature and a short-lived, user-associated ZAK issued only after exact tenant, session, meeting, and host authorization, or a meeting-bound OBF token for an entitled member join. MentorU does not persist or log those short-lived credentials.

• OAuth state is usable for no more than five minutes. The cross-host selection handoff is usable for no more than fifteen minutes. Sensitive transaction material is cleared after use, cancellation, terminal failure, or expiry.
• OAuth access and refresh tokens are retained only while the exact connection remains active. A confirmed disconnect or valid provider deauthorization disables the connection and removes usable credentials from active storage immediately.
• Meeting SDK signatures, ZAK, and OBF are requested just in time, are not persistently stored by MentorU, and expire according to Zoom's short-lived credential rules.
• Zoom meeting metadata is retained with the corresponding workspace session while that session or workspace remains active. A mentor can delete the Zoom-backed meeting through MentorU. Covered active records associated with a verified deletion request or workspace closure are targeted for deletion or de-identification within 30 days unless an exception below applies.
• Secret-free provider lifecycle audit evidence is append-only and retained for the operating life of the MentorU service to preserve connection-history, replay, and tenant-boundary accountability. It contains no OAuth credentials, authorization codes, state, cookies, tokens, or secrets.

Retention may be extended when reasonably necessary for an active security investigation, fraud prevention, tax or accounting duty, dispute, litigation hold, or other legal requirement. Access remains restricted during the exception, and deletion resumes when the exception ends. Verified access or deletion requests may be sent to support@mentoru.app.

MentorU reviews production dependencies and security-sensitive code before release, monitors provider and package advisories, and records findings by severity and affected surface. Critical findings are targeted for triage within one business day and mitigation within 72 hours. High findings are targeted for triage within three business days and remediation within 14 calendar days. Moderate findings are targeted for remediation within 30 days and low findings within 90 days. A documented exception must identify the owner, exposure, compensating controls, and review date.

A known exploitable critical or high finding affecting the submitted application blocks release until remediated or explicitly contained and reviewed. Reports may be sent to support@mentoru.app with “Security report” in the subject. Do not include live secrets or personal data that is not needed to explain the issue.

MentorU's incident process covers detection, validation, severity assignment, containment, evidence preservation, eradication, recovery, monitoring, required notification, and a post-incident review. Kahel Ventures coordinates the response and engages affected infrastructure or provider teams when necessary. Access may be disabled, credentials revoked or rotated, effects denied, or a release rolled back to contain risk.

Confirmed incidents are documented without placing credentials or unnecessary customer content in the incident record. MentorU notifies affected parties and authorities when required by applicable law, contract, or provider rules. Critical unauthorized-access reports are acknowledged within one business day during the published support schedule.

• MentorU uses Vercel for application hosting and Supabase for authentication and PostgreSQL. Zoom, Stripe, and Resend are used only for the connected capabilities described to users.
• Production identities, environment configuration, domains, migrations, dependency locks, and rollback targets are verified before release.
• Dependencies are pinned or lockfile-resolved, reviewed for advisories, updated through a tested candidate, and replaced before end of support when they remain in a sensitive path.
• Provider access is limited to the data and permissions required for the enabled feature. Provider connection never by itself authorizes an external send, meeting, charge, publish, or other effect.
• Infrastructure providers are evaluated for security, availability, confidentiality, and data-protection terms appropriate to the data they process. Access is removed when a provider is no longer required.

MentorU uses immutable application candidates, staged smoke checks, and a verified application rollback target. Recovery work must preserve tenant boundaries and must not intentionally restore revoked provider credentials or deleted data to active use. Material incidents receive a post-recovery review and follow-up actions.

Infrastructure providers may maintain restricted recovery copies under their own contracted service and current configuration. MentorU does not publish a fixed backup-retention window without current provider evidence. If recovery reintroduces data covered by an outstanding deletion obligation, that obligation must be re-applied before normal use resumes.

This policy records MentorU's security and data-protection commitments effective August 15, 2026. It does not claim historical completion of every recurring review or exercise. MentorU does not claim SOC 2 or ISO certification, a formal SAST/DAST program, or an independent third-party penetration test unless a current report explicitly says otherwise. No internet service can guarantee absolute security.

Send security, privacy, or data-protection questions to support@mentoru.app.