Security, stated plainly
What Mendiola does to keep a firm's companies apart, who can change a client's books, and where the data is. If a statement here stops being true, we change the product or the page the same day.
Where your data goes
Every service that touches a firm's data, the country it runs in, and what flows between them. Choose one to see what it holds, who reaches it, and what stops it.
Jaz ledger
Your clients' books, Singapore- What it holds
- Your clients' books. Jaz keeps every organization's books in Singapore, US companies included.
- Who reaches it
- Mendiola reads the books for checks and reviews. It writes only drafts and the changes a person approves.
- What stops or guards it
- Sending to Jaz is off for each company until an admin turns it on, and we can stop it for a company at once, without a release.
Who gets in
Invitation only
Mendiola sets up each firm with its first admin. There is no public sign-up; everyone else joins a firm by invitation.
A code on sign-in
Signing in asks for a code sent to your email, as well as your password or a passkey.
Admins and members
Admins configure the firm and its companies. Members work on the companies they are assigned to.
Private companies
A company marked private is seen only by the person who created it. Another admin gets the same answer as a stranger: not found.
Who can change a client's books
Off until switched on
Sending documents to the ledger is off for each company until an admin turns it on, and we can stop it for a company at once, without a release.
Proposals wait for a person
Bank matches and accruals are proposals. One change reaches the ledger only when a person approves it, after Mendiola re-reads what it is about to change.
Agents read and draft
An agent can read books and files and draft an email. A change in the ledger waits for the asker's click on a confirmation, and nothing is ever sent for you.
Every change names who made it
The activity log records who made each change, a person or Mendiola on a person's behalf, and it is append-only.
Where data is kept
Mendiola
The database and web application run in Singapore. Background jobs run in the United States (US East).
The ledger
Jaz keeps every organization's books in Singapore, including those of US companies.
Files
Documents are stored privately and served only to people who can open their company, never from a shared cache.
Keys
A person's own ledger key is encrypted (AES-256-GCM) with a key that is not kept in the database.
What we don't claim
Mendiola has no SOC 2 report and no ISO 27001 certificate today. When it has one, it will be listed here with its date. We don't describe our security as "bank-level".
To report a security concern, write to connect@mendiola.io.
See your own close in Mendiola.
We'll walk through a month for one of your companies, with the people who built it and use it every day.
- Prepared
- Mendiola
- Reviewed
- Your reviewer
- Signed off
- Your partner