Security

Last updated: 2026-10-11

Security is a precondition for everything else Minima Technologies, Inc. ("Minima") does. This page describes the controls we have in place today and the practices we commit to as the platform grows. It is intentionally specific so that customers, auditors, and security researchers can hold us to it.

All traffic between your client and Minima is encrypted in transit using TLS 1.2 or higher. Internal service-to-service traffic between our application servers, databases, and worker fleet runs over authenticated, encrypted channels.

Data at rest is encrypted by our underlying providers. Convex stores your canonical project data on AWS infrastructure with disk-level encryption. Worker disks on Google Cloud are encrypted, and object storage for rendered media uses server-side encryption. Payment data is held by Stripe; we never store raw card numbers.

Minima uses Better Auth for sign-in. There is no password: you sign in with a one-time code we email you or with an OAuth provider. We rate limit sign-in attempts, and we hash every API key before storing it.

• OAuth sign-in with Google and Apple. We request only the scopes that identify you: email,profile, and openid from Google, andemail and name from Apple.
• Email one-time codes: a code sent to the address on your account, which expires after a few minutes.
• Hashed API keys: secret values are shown once at creation and stored as a hash, alongside the first few characters so you can tell one key from another. Lost keys must be rotated.

The app offers no way to enrol a passkey or a second factor yet, so in practice the only factor an account holds is control of its email address or of its Google or Apple identity. We will describe a second factor here when it can be enrolled, not before.

Production access to systems holding customer data is restricted to a small number of named engineers, and reviewed regularly.

• Role-based access control for organization members, with admin, editor, and viewer roles.
• Least-privilege production access: engineers access customer data only when necessary to investigate a support request, debug a defect, or respond to an incident.

We rely on a small set of well-understood, security-mature providers. Each is bound by a Data Processing Agreement.

• Convex hosts our primary database, real-time sync, and serverless functions on AWS.
• Google Cloud runs the agent worker pool, the rendering pipelines (audio, image, video), and the services behind them. The pools that hold your project data while a job runs take no public ingress; they pull work rather than receive it. One Google Cloud service does accept public requests — the one our database calls to index your memories and resources and to transcribe voice messages, because the database holds no Google credentials. Every route on it that touches your data requires a secret shared only with our database; an unauthenticated caller reaches nothing but a health check.
• Vercel serves the web client and this site.
• Tigris stores uploaded and rendered media and serves the desktop app's downloads and updates, andChroma stores the vector index used for search and retrieval.
• OpenRouter serves every request we make to a language model, forwarding it to the model provider that runs it. The Data Use page describes the limits we place on where it can be routed.
• Deepgram transcribes voice messages you record.
• Stripe handles payments. Stripe is a PCI DSS Level 1 service provider; raw card data never touches Minima.
• Cloudflare provides authoritative DNS forminima.dev.

Workers run in one US region today. We will add regions as we expand, so that compute for EU customers happens closer to them.

We maintain an incident response runbook covering detection, containment, forensic preservation, regulator notification, customer notification, and post-incident remediation. We rehearse it.

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, in line with Article 33 of the GDPR. Affected users will be notified without undue delay where the risk is high.

If you believe you have found a security issue in Minima, please email security@minima.devwith a clear description and reproduction steps. We aim to acknowledge reports within two business days.

In scope: the public Minima web app, the Minima API, the desktop app and its downloads ondownloads.minima.dev, and any service running on aminima.dev domain.Out of scope: denial-of-service testing, social engineering of our staff or vendors, physical attacks, and automated scanner findings without a working proof of concept.

We will not pursue legal action against researchers who act in good faith, follow this scope, give us a reasonable opportunity to fix issues before public disclosure, and avoid accessing or exfiltrating data beyond what is needed to demonstrate the issue.

Minima is an early-stage product. We do not yet hold our own SOC 2 or ISO 27001 certifications. We rely on certified vendors for the foundational layers: AWS, Stripe, and our authentication and hosting providers. We are tracking certification work as the company matures. We will update this page as that posture changes.

Report a vulnerability: security@minima.dev