MITHDUIN← mithduin.com
Security · Always on

Your record is in safe hands.

From encryption to access boundaries enforced by the database itself, Mithduin treats your record as the most sensitive file a person keeps — because it is. This note says exactly what the system does today, and what it does not claim yet.

Go to the trust centre

The architecture, plainly

Mithduin is a small system with a small attack surface: static pages, one database, one private document store, and two narrowly-scoped functions. There is no sprawling estate of services to secure — and the controls below are enforced by the platform, not by promises.

Isolation enforced by the database

  • Every table carries row-level security: a signed-in client can only reach rows in their own workspace.
  • The boundary is evaluated by Postgres on every query — application code cannot bypass it.
  • Advisory staff access is a defined role, and staff actions are written to the same visible log.

Encryption & the vault

  • TLS on every connection; AES-256 encryption at rest.
  • Documents live in a private bucket with no public URLs; files open only through signed links that expire in five minutes.
  • A SHA-256 fingerprint is recorded for each new upload, so a file’s integrity can be proven later.

Read-only by design

  • The Interactive Brokers connection uses a Flex token: it retrieves statements and positions and cannot trade or move funds.
  • Tokens can be scoped to a single IP and revoked by the client at any time.
  • Mithduin can see. It can never move.

AI with guardrails

  • Suggestions start from deterministic rules over your own record — the model writes prose, it cannot invent a finding.
  • Only a structured summary of relevant fields is sent to the model provider; your documents never are.
  • Commercial API terms prohibit training on your data. Nothing is sold to anyone.
What we do not claim yet.

Mithduin holds no third-party certifications today. SOC 2 readiness, an external penetration test, and two-factor sign-in with passkeys are on the near-term roadmap, and this page will say so plainly when each lands — not before. If a claim on this page matters to your decision, ask us to evidence it: office@mithduin.com.

Questions & documents

The trust centre holds the controls list, available documentation and answers to common due-diligence questions. The one-page overview covers the product itself.