Review MENTARA's stated security practices, engagement controls and current assurance status. Confirm the requirements for your systems and data before access is granted.
Trust & Security
Security, data handling and supplier assurance
Review MENTARA's stated security practices, engagement controls and current assurance status. Confirm the requirements for your systems and data before access is granted.
How we can help
02
Our certification position.
State today
MENTARA does not hold ISO 27001 certification, a SOC 2 report, or an equivalent third-party security attestation. No certification audit has been completed, and none is in progress with an appointed auditor.
Where your procurement policy requires a certified supplier as a precondition, that is worth establishing in the first conversation rather than the fifth. Two routes usually work: a contained engagement that does not touch production or regulated data, or MENTARA working under a certified prime.
Verifiable controls
What you can check without taking our word for it.
These statements describe specific website and application controls. Review their current implementation and scope as part of supplier assessment.
Technical controls, internal practices and contractual commitments provide different kinds of evidence. None substitutes for an independent certification or attestation. Confirm the controls relevant to your engagement before granting access.
- HTTPS enforced for a year ahead, across every subdomain — HSTS with a max-age of 31,536,000 and includeSubDomains.
- A restrictive content-security policy: everything defaults to this origin, plugins and embedded objects are blocked outright, form submissions cannot be redirected off-site, and every permitted third-party host is named individually rather than wildcarded.
- Framing denied twice over, through both the content-security policy and X-Frame-Options, so clickjacking is blocked even on a browser that honours only one of them.
- Browser capabilities switched off at the page: camera, microphone, geolocation, USB and topics-based ad tracking. Payment is delegated on the payment route alone, and only to the checkout provider's own origin.
- Referrer information withheld entirely on administrative pages, and restricted to the origin everywhere else.
- Administrative access authenticated by Cloudflare Access before a request reaches the application at all, then authorised again against a per-role permission map, with destructive publishing operations restricted to a single role.
- Privilege grants written to an audit log recording the acting account — including the initial bootstrap grant, on the reasoning that a silent first privilege is precisely the one nobody ever reviews.
- Anti-abuse rate limiting keyed on a SHA-256 hash of network address and user agent. The raw values are never written to the database, so the record cannot be resolved back to a visitor.
- Administrative and API responses marked no-store, so nothing authenticated is retained by an intermediate cache.
- Database schema held under versioned migrations, and every change gated on a pipeline that lints, runs the full test suite and validates a production build before anything can deploy.
Engagement controls
What is committed contractually in every engagement.
These are terms we sign up to, which means they are enforceable against us regardless of what any certificate would or would not say.
Data protection
Working across several regulatory regimes at once.
MENTARA works across India, the United States, the United Kingdom and Europe, and the Middle East and wider Asia-Pacific, so an engagement may fall under any of several regulatory regimes. These differ in ways that matter operationally rather than only legally, so we treat data protection as engagement-specific rather than as a single global policy statement.
In practice this means establishing four things during scoping, before any access is granted: which categories of personal or regulated data the work will touch; which jurisdictions the data subjects and the processing sit in; whether any transfer outside those jurisdictions is required and on what legal basis; and who is controller and who is processor for each dataset involved.
MENTARA is registered in India and subject to the Digital Personal Data Protection Act. Where an engagement involves UK or EU personal data, the applicable UK GDPR or GDPR obligations are addressed through the engagement's data-processing terms, including transfer mechanisms. Where it involves US healthcare or financial data, the specific regime is identified in scoping rather than assumed to be covered by a general clause.
We will not accept regulated data into an engagement on the basis of a general assurance. If the scoping conversation cannot establish the four points above, that is a signal the engagement is not ready to start.
Internal practice
How MENTARA runs itself.
Described as practice, not as certified control. The distinction is deliberate: none of this has been audited by an independent third party.
A firm of our size should be honest that these are operating practices maintained by a small team, not a control environment validated by an auditor. They are the practices we would want a supplier of ours to have.
- Multi-factor authentication on all company accounts and services, without exception for convenience.
- Company devices with full-disk encryption, automatic screen lock and managed updates.
- Secrets and credentials held in a dedicated secret manager, never in source control, documents or messages.
- Changes reach production through reviewed pull requests, and deployment runs from the pipeline rather than from anyone's machine. Worth stating precisely: that is a discipline this team keeps, not a branch rule the hosting platform enforces on our behalf.
- Production dependency high and critical findings block the pipeline, pull requests receive dependency review, and the weekly advisory review remains in place for lower-severity and development-tool findings.
- A maintained record of every third-party service that could process client data, reviewed before adoption rather than after.
- Access review whenever someone joins, changes role or leaves — and on a scheduled cadence regardless.
Intent
What we are working toward, stated as intent.
Included because you will ask, and because a supplier who cannot describe their trajectory is telling you something. None of this is complete, and none of it should be treated as a claim.
01 Documented ISMS
A written information-security management system covering policy, asset inventory, risk assessment and review cadence — the prerequisite for any certification path, and worth having on its own merits.
02 Internal security assessment
Threat-led review, automated scanning, manual misuse-case testing and recorded remediation before any formal certification decision. This is internal assurance and is not presented as third-party attestation.
03 Independent assurance
A future ISO 27001 certification process or SOC 2 examination would be selected according to business requirements. Neither is completed or in progress with an appointed auditor. Any future assurance claim will identify its actual scope and evidence.
04 Continuous evidence
Control evidence generated as a by-product of how we work rather than assembled ahead of an audit window.
Security review
The questions your security team will ask.
Will you complete our security questionnaire?
Yes, and we will answer it accurately, including the answers that count against us. Where the honest answer is “no” or “not yet”, that is what the response will say rather than a description engineered to read as compliant.
If a “no” on a mandatory item disqualifies us, we would rather establish that at questionnaire stage than consume more of your team's time.
Where is our data processed and stored?
Wherever the engagement specifies, agreed before work starts. Our strong default is that client data stays in the client's own environment and jurisdiction, and that MENTARA works inside it rather than extracting data into our systems.
Where something must be processed outside your environment, it is identified specifically during scoping — what, why, where, for how long, and under what legal transfer basis.
Do you use subcontractors or offshore delivery?
Any individual working on your engagement is disclosed to you by name, along with their employment relationship to MENTARA and their location. You approve who has access to your environment.
We do not subcontract work to undisclosed third parties, and we do not move work to a location you have not agreed to.
Do you use AI tools on client work?
Only under terms agreed with you in advance, and never with client code, data or confidential material submitted to a service that trains on submitted content.
Where AI-assisted development is used, it is disclosed, the tooling is named, and the same review standards apply to that output as to anything else. If your policy prohibits it, we work without it and say so honestly rather than quietly continuing.
What insurance do you carry?
Cover is confirmed in writing during contracting, with the specific policies and limits stated. We do not publish them here, because insurance requirements differ substantially by client, engagement type and jurisdiction, and a general figure would be of no use to your risk team.
How do we report a security concern?
Email sales@mentaraglobal.com with “Security” in the subject line and we will route it to the accountable owner. If you are reporting a suspected vulnerability in this website or in something we have built for you, we will confirm receipt and tell you who is handling it.
We will not pursue anyone who reports a genuine security issue to us in good faith.
One partner. One plan. Measurable outcomes.