Security
How Mena protects your patients' data
Where your data is stored, how it is encrypted, who can open it and what the AI does with it. Each point describes how the platform works today.
Where your data lives
Mena runs on Microsoft Azure in the European Union.
EU data centres
The application, its database and file storage run in Microsoft Azure's Spain Central region.
A private network
The database and file storage have no public internet access. Only the application reaches them, over private connections.
Backups
The database is backed up automatically, with point-in-time recovery for the last 14 days, and keeps a standby copy in a second availability zone.
Encryption
Data is encrypted in transit and at rest, and sensitive fields get a second layer.
A separate key for each clinic
Sensitive personal and clinical fields are encrypted by the application with AES-256-GCM, using a key that belongs to one clinic only.
Encrypted at rest
The database and file storage, session recordings included, are also encrypted at rest by Azure.
Encrypted in transit
Every connection uses HTTPS with HSTS. Connections to the database and storage require TLS 1.2 or later.
Who can open it
Each person in your clinic sees what their role allows.
Roles
Every member of the clinic has a role, and the role decides what they can see and change.
Two-factor authentication
Every user can turn on two-factor authentication with an authenticator app, with backup codes in case a phone is lost.
Passwords and sessions
Passwords are stored as bcrypt hashes. Sessions use secure, httpOnly cookies with CSRF protection.
Limits on sign-in attempts
Sign-in and two-factor attempts are rate-limited, and a web application firewall sits in front of the platform.
Access is logged
Views and exports of patient records are written to an activity log.
AI we run ourselves
Transcription and note drafting run on AI models we host in the same Azure region.
No outside AI providers
Session audio, transcripts and notes are not sent to third-party AI providers.
Drafts you can change
Notes Mena drafts are marked as AI-generated, and you can edit or delete them at any time.
Exporting and deleting data
The clinic decides what to keep and what to take with it.
Export at any time
Export the whole clinic's data, or a single patient's, as a download whenever you need it.
Consent records
Patient consents are stored with the patient record.
Session recordings
Recordings are kept until you delete them, and you can delete any recording permanently.
Data processing agreement
Our data processing agreement under Article 28 of the GDPR is available to customers and to clinics evaluating Mena.
Sub-processors
We rely on a small number of providers to run the service, such as cloud hosting, payments and invoicing.
The binding list
Each sub-processor, its location and its transfer safeguards are listed in Annex II-B of our data processing agreement.
Notice before changes
We email customers at least 30 days before adding or replacing a sub-processor, and you can object.
Questions
Is Mena certified to ISO 27001 or SOC 2?
No. Mena does not hold a security certification today. This page describes the controls in place, and our data processing agreement sets out our commitments.
Is two-factor authentication required?
It is optional for each user. We recommend turning it on for everyone who opens clinical records.
How do I report a security issue?
Write to dpo@mena-ai.pt with what you found and how to reproduce it.
Questions about your data?
We'll walk you through hosting, encryption and our data processing agreement in a demo.