Security

Last updated: 24 April 2026.

This page summarises the safeguards built into the Mendmate application and the operational principles we follow. Mendmate is an evolving product; this is a factual overview, not a certification statement.

Authentication & access

  • Passwords are hashed with bcrypt; cleartext passwords are never stored.
  • JWT-based sessions with configurable expiry; credentials travel only via Authorization headers, not URLs.
  • 5-failed-attempt lockout and 15-minute account lock to deter credential stuffing.
  • Rate limits on all authentication endpoints (20/hr) and the forgot-password endpoint (3/hr).

Network & transport

  • All production traffic is HTTPS with HSTS enabled.
  • Security headers: HSTS, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, Permissions-Policy.
  • Strict CORS allowlist — not substring-based.

Data at rest & in transit

  • MongoDB Atlas hosts the primary database with encryption at rest; automated backups are being added as we scale.
  • Cloudinary stores images and signatures.
  • Payment card data is handled by Stripe; Mendmate never stores full PAN or CVV.

Sub-processors

MongoDB Atlas, Render, Cloudflare, Brevo, Stripe, Cloudinary. See the Privacy Policy for the role each plays.

Operational principles

  • Administrative routes fail closed if middleware fails to load.
  • Stripe webhook signatures are verified against the raw request body before JSON parsing.
  • Secrets are held in environment variables, never committed to source control.
  • Only minimum-necessary personal data is logged; signature-input payloads for print jobs are never logged.

Compliance posture

Mendmate is UK-built and aims to align with UK GDPR obligations as a data processor. ICO registration is pending. A Data Processing Agreement is available on request.

Reporting a vulnerability

If you believe you have found a security issue, please email security@mendmate.co.uk with steps to reproduce. We aim to acknowledge within 2 working days. We ask that you avoid public disclosure until a fix is released.