Security & Compliance

What we do with data

MentionFox runs open-source intelligence (OSINT) on public information. Exactly what we collect and where it lives:

What we don't do

• We don't scrape private databases. Every source we touch is public. No paid data brokers, no leaked credentials, no purchased lists.
• We don't store EU/UK private personal data outside what's already public. If it's on someone's LinkedIn or in a published article, we may cite it. If it's behind a login wall or in a private database, we don't have it.
• We don't sell or rent a "lead list." Every subject is researched on demand against a name you provided. We have no pre-built contact database for sale.
• We don't send email from our servers. Outbound goes through your warmed sending domain via Brevo SMTP. SPF / DKIM / DMARC live in your DNS — we provide setup instructions, you control the records.
• We don't share your account data with third parties for advertising. The only advertising tag is Google's, used to measure our own Google ads: it runs in Google Consent Mode, sets no advertising cookies unless you choose Accept All, receives no personal data, and is not loaded at all for browsers sending Global Privacy Control or Do Not Track (Cookie Policy). Analytics via Umami (cookieless).

Email deliverability — SPF / DKIM / DMARC

Outbound sequences ship through Brevo SMTP using your sending domain, not ours. Authentication is your DNS to control:

• SPF — Add Brevo's send servers to your sending domain's SPF record.
• DKIM — Brevo provides DKIM keys to publish in your DNS. Setup instructions in your account dashboard.
• DMARC — We recommend p=none reporting at minimum; p=quarantine once SPF and DKIM are stable.

Brevo's authentication docs: help.brevo.com/.../12163873383186. Because the records live on your domain, MentionFox's reputation cannot pollute yours, and vice versa.

GDPR & Data Processing Agreement

Our Data Processing Agreement applies automatically to every MentionFox customer, on every plan. Read it at /privacy/dpa. If your procurement needs a countersigned copy, email legal@mentionfox.com.

We are GDPR-aligned in design:

• Subjects of any MentionFox report can request removal — see "Subject removal" below. We delete within 7 days.
• Account holders can export their account data or delete their account from /dashboard/settings.
• We don't claim to be "GDPR certified" — no such certification exists. Compliance is a design property, not a badge.

SOC 2 Type II Not yet

We are not currently SOC 2 Type II certified. We are evaluating audit timelines for Q3 2026. If your procurement requires SOC 2, email saul@ritekit.com with your timeline — we'll let you know if our Q3 estimate fits.

Sub-processors

MentionFox uses these third-party services to operate. Each has its own privacy / data-handling policy.

Subject removal — if you're in a MentionFox report

If you are a subject of a MentionFox report and want it removed:

1. Email saul@ritekit.com with the report URL (the one starting with mentionfox.com/vetting/...).
2. We delete the report row + cached HTML within 7 days. No questions, no friction.
3. Public data we cited remains public — we don't have the power to remove a LinkedIn profile or news article. We only remove our cache of it.
4. If a report's existence harms you AND the public data behind it is also wrong, contact the original source (the news site, the LinkedIn owner) separately. MentionFox's deletion doesn't fix upstream errors.

Encryption

• In transit — All data transmitted between your browser and MentionFox is encrypted via TLS 1.2+. We enforce HTTPS on all endpoints with HSTS headers.
• At rest — Data stored in our database is encrypted using AES-256, managed by Supabase / AWS.
• Secrets — API keys, tokens, and credentials are stored in Supabase Vault with additional application-level encryption.

Authentication & access

• Password security — Passwords are hashed via bcrypt with per-user salts. We never store plaintext passwords.
• Session management — Sessions use JWTs with configurable expiry. Stored in browser localStorage and validated on every request.
• Row-level security — Supabase RLS policies ensure users can only access their own data. Every database query is scoped to the authenticated user.
• Service-role isolation — Administrative operations use separate service-role credentials that are never exposed to the client.

Infrastructure

• Database — Supabase (managed PostgreSQL on AWS), Sydney region (ap-southeast-2). Supabase maintains SOC 2 Type II.
• Frontend — Vercel edge network with global CDN distribution, automatic DDoS protection, and SOC 2 Type II.
• DNS & CDN — Cloudflare for DNS management and edge caching with WAF protection.
• Payments — Stripe handles all payment data. PCI DSS Level 1. MentionFox never stores credit card numbers.

Application security

• Input validation — All user inputs are validated and sanitized before processing.
• CORS — Cross-origin requests restricted to authorized domains only.
• Rate limiting — API endpoints rate-limited to prevent abuse.
• Dependency hygiene — Third-party dependencies audited and updated regularly.

Incident response

If a security incident occurs:

• We investigate and contain immediately.
• Affected users notified within 72 hours of confirmation.
• Supervisory authorities notified as required by GDPR and applicable law.
• Post-incident report documents timeline, impact, root cause, remediation.

Responsible disclosure

If you discover a security vulnerability in MentionFox, please email saul@ritekit.com. We aim to acknowledge within 24 hours and patch P0 issues within 7 days. We will not pursue legal action against researchers who report vulnerabilities responsibly. Coordinated disclosure with 30 days advance notice is welcome.

Contact