Solutions

Customers

Services

Security

Book a Demo

Solutions

Customers

Customer Stories

See how Mando is used in the field day-to-day

Blog

Our thoughts on the application support space

White Paper

Learn about the architcture that drives Mando

Services

Security

Troubleshooting

Fix issues faster with AI-powered search

Documentation

World-class documentation in seconds

Training

coming soon

Real-time learning for Workday admins

Audit Readiness

coming soon

Continous visibility, searchable in real time

Testing

coming soon

Agents that test your environment like a human

Solutions

Customers

Customer Stories

See how Mando is used in the field day-to-day

Blog

Our thoughts on the application support space

White Paper

Learn about the architcture that drives Mando

Services

Security

Troubleshooting

Fix issues faster with AI-powered search

Documentation

World-class documentation in seconds

Training

coming soon

Real-time learning for Workday admins

Audit Readiness

coming soon

Continous visibility, searchable in real time

Testing

coming soon

Agents that test your environment like a human

Trusted by infosec.
Loved by admins.

Frontier AI technology grounded in enterprise-grade security, transparent compliance, and a zero-knowledge architecture. Trusted by public enterprises, government institutions, and breakout startups worldwide.

Trust Center

Compliant with

At a glance

Data Isolation

Customer data is logically isolated by tenant with strict authorization controls.

Access Controls

Role-based access control, multi-factor authentication, and audited administrative access.

Secure Development

Enterprise-grade software development lifecycle practices and security scanning.

Encryption

All data is encrypted in-transit and at rest using industry-leading cryptographic protections.

Resilience

Regular backups, continuous monitoring, and tested recovery procedures.

Transparency

Compliance and security documentation available in our Trust Center.

Security Principles

Mando is built around least privilege with strong tenant boundaries by default, so enterprise customers can confidently adopt AI without data risk.

Least privilege by default across systems and people

Continuous vulnerability scanning across app, data, and infrastructure layers
Auditability with comprehensive logging and monitoring
Customer control over data sources, permissions, and retention

Customer data is used to provide the service, not to train shared models
Tenant-scoped retrieval and indexing
Access-controlled connectors and source permissions
Administrative controls limit what content is searchable and by whom
Responses can include references so users can verify accuracy

AI Policies

Mando does not train models on customer data. Workflows are designed to prevent one customer’s information from influencing another's results.

Encryption & Monitoring

All data is encrypted in-transit and at rest. All access is hardened via 2FA and optional SSO/SAML support. All administrative actions are logged and monitored.

Encryption in-transit using TLS 1.3 or higher (when available)
Encryption at rest using AES-256 encryption
Support for customer-defined encryption keys for added security and compliance
Authentication via 2FA by default with support for SSO/SAML
Role-based access control for all permissioned actions
Centralized logging and alerting with defined escalation paths and response playbooks

Regular backups and restore procedures

Annual disaster recovery planning and testing cadence
Configurable RPO/RTO targets for enterprise plans

Backup & Recovery

Enterprise reliability is more than uptime, it requires recoverability. Mando maintains backups and procedures to support restoration and continuity.

Frequently asked questions

Do you train AI models on our data?

By default, no. Customer data is used to provide the service and is not used to train shared models unless an enterprise customer explicitly requests a custom model via written agreement.

How is our data isolated from other customers?

Mando enforces tenant-scoped authorization and data access controls, so users can only access data within their organization based on their role.

Who at Mando can access our data?

By default, nobody. Administrative access follows lease-privilege practices and continuously monitored. In the unlikely event of an incident, administrative access is temporarily granted for the duration incident response and promptly revoked upon resolution.

Where is data stored and can you support data residency requirements?

By default, data is stored in US-based data centers. For enterprise customers with specific residency needs, Mando can support custom deployment and configuration options.

What third parties/subprocessors do you use?

We maintain an up-to-date list of subprocessors and their roles in our Trust Center, along with applicable data protection terms.

Do you have third-party security testing?

We perform continuous security testing and annual penetration testing, including independent assessments. Relevant documentation is available in our Trust Center.

Do you train AI models on our data?

By default, no. Customer data is used to provide the service and is not used to train shared models unless an enterprise customer explicitly requests a custom model via written agreement.

How is our data isolated from other customers?

Mando enforces tenant-scoped authorization and data access controls, so users can only access data within their organization based on their role.

Who at Mando can access our data?

Where is data stored and can you support data residency requirements?

By default, data is stored in US-based data centers. For enterprise customers with specific residency needs, Mando can support custom deployment and configuration options.

What third parties/subprocessors do you use?

We maintain an up-to-date list of subprocessors and their roles in our Trust Center, along with applicable data protection terms.

Do you have third-party security testing?

We perform continuous security testing and annual penetration testing, including independent assessments. Relevant documentation is available in our Trust Center.

Do you train AI models on our data?

By default, no. Customer data is used to provide the service and is not used to train shared models unless an enterprise customer explicitly requests a custom model via written agreement.

How is our data isolated from other customers?

Mando enforces tenant-scoped authorization and data access controls, so users can only access data within their organization based on their role.

Who at Mando can access our data?

Where is data stored and can you support data residency requirements?

By default, data is stored in US-based data centers. For enterprise customers with specific residency needs, Mando can support custom deployment and configuration options.

What third parties/subprocessors do you use?

We maintain an up-to-date list of subprocessors and their roles in our Trust Center, along with applicable data protection terms.

Do you have third-party security testing?

We perform continuous security testing and annual penetration testing, including independent assessments. Relevant documentation is available in our Trust Center.

Need more details? No problem.

Our Trust Center offers the latest details about our architecture, protocols, and evaluations. Access security policies, compliance certifications, third-party assessments and detailed insights about our data protection practices.

Access our Trust Center