Before you decide
Four facts reviewers ask first.
- AI, voice and search run outside EuropeYour space is hosted in the Netherlands, but each request sends the content it needs to AI, voice and web search providers, mostly in the US (Anthropic, ElevenLabs, OpenRouter), under standard contractual clauses or the Data Privacy Framework. One fallback search provider is in China. Full list.
- No model trained on customer content todaySome test sets that check Star's answers already hold de-identified lines from customer conversations, organisation spaces included. We may train our own models later. Anyone can object, an organisation can object for its whole space, and Enterprise customers can opt out by contract.
- Live conversations not yet encrypted at restIn progressUploaded files, connected-account keys, drives and backups are encrypted. Conversations and recordings on the live server disk are not yet, so our staff with server access could read them.
- No independent audit or penetration test yetPlannedNothing here claims a standard we have not met. See the roadmap.
Documents
The binding texts, in English.
Security practices
01 · IN PLACEEach line is true as of 20 October 2026. Each one has an internal evidence owner we can show an auditor.
- Encrypted in transitIn place
Every connection to a space uses TLS. Our own access to the servers runs over Tailscale, which encrypts it end to end.
- Passwords stored as one-way hashesIn place
We store passwords only as Argon2id hashes. Nobody at Mainstar can read your password.
- Documents and connected-account keys encrypted at restIn place
Files you upload and the keys for accounts you connect are sealed with AES-256-GCM. The key lives in our password manager, not on the server's disk.
- A private encrypted drive per personIn place
Within two minutes of a change, each person's room data is copied to their own drive on Worldstream object storage in the Netherlands, encrypted before it leaves the server.
- Encrypted backups, restore tested weeklyIn place
Backups are encrypted, file names included, before they leave the server. Every week we restore one and check it.
- Passkey step-up for sensitive actionsIn place
Actions that remove or reveal data ask for a passkey. If no passkey gate is configured, the action is refused rather than allowed.
- Each person's data kept apartIn place
Memory, notes, agenda and files belong to one person. Automated tests check that another person in the same space cannot read them.
- Closed route admissionIn place
The server answers only routes on an explicit list, each with its own access rule. A test fails the build if a route is added without one.
- Secrets kept out of logsIn place
Log lines pass through a redaction filter that strips keys and tokens before anything is written.
- Pages Star builds run in a sandboxIn place
Anything Star builds for you as a web page runs in a locked sandbox with no network access.
- Short-lived admin access, second factor for operatorsIn place
The admin credential is renewed at every restart and expires on its first use after twenty-four hours. Operator sign-in requires a second factor.
- Mail to us arrives; mail from us is authenticatedIn place
legal@, privacy@, support@ and security@mainstar.ai receive mail through Cloudflare Email Routing. Our outgoing mail is sent through Amazon SES with SPF and DKIM, under a published DMARC policy, and bounced addresses are suppressed.
- Written breach procedure with a 72-hour clockIn place
If a breach affects your data we tell you without undue delay and, where we can, within 72 hours. The procedure is written; its first full exercise is planned.
Still being built
02 · IN PROGRESSWhere today falls short of what our Privacy Policy and DPA commit to. Each gap closes here, in public.
- Encryption of all live data on our own disksIn progress
Documents and keys are encrypted at rest today. Conversations and recordings on the live server disk are not yet; the encrypted volume is being prepared.
- Monthly backup copies capped at 90 daysIn progress
Our policy keeps monthly copies for at most 90 days. The backup job does not yet delete them on that schedule.
- A log of staff access to customer contentIn progress
Access to customer content is limited to the people who run and secure the Service. A per-access log of who read what does not exist yet.
- Export and delete everything from SettingsIn progress
Settings, then Your data, with your password to confirm. Until it reaches every space, write to legal@mainstar.ai and we do it for you.
Your data
03- Where it livesYour space runs on Worldstream servers in the Netherlands. Each person's data is copied to their own encrypted drive on Worldstream storage in the Netherlands.
- BackupsEncrypted before they leave the server. Change copies every five minutes, kept 7 days; nightly copies kept 90 days. Monthly copies are meant to go after 90 days, but are not yet deleted on that schedule.
- DeletionWhat you delete, or everything when you close your account, leaves your space at once. Encrypted backups may hold it, outside ordinary use, for up to 90 days once the monthly limit is enforced; until then, monthly copies have no end date. If we restore a backup, we reapply deletions first.
- Export and deleteFrom Settings, then Your data, confirmed with your password. Where that is not yet available, write to legal@mainstar.ai.
- Training, todayNo model is trained on content from customer spaces. Some of our test sets, which check Star's answers, contain de-identified lines from customer conversations.
- Training, laterWe may use content and usage to improve and train our own models, de-identified where practical, kept on our own infrastructure.
- Your choiceAnyone, with or without an account, can object at legal@mainstar.ai. Enterprise customers can opt out by contract. Objecting does not change how Star works for you.
- AI, voice and search providersThey process what each request needs. Our rule is to use them only on terms or settings under which they do not train their own models on what we send them.
- NeverWe never sell your personal data and never use it for advertising.
Privacy rights: GDPR, UK GDPR and Swiss FADP
04Your rights, and how to use them
- Access, copy, correction, deletionWrite to legal@mainstar.ai. We answer within the legal deadline, generally one month, and confirm deletions in writing.
- Restriction and objectionIncluding objection to training, open to anyone, with or without an account.
- PortabilityA portable copy of your content, from Settings or by e-mail.
- Security reportssecurity@mainstar.ai.
- ComplaintYou can contact the data protection authority where you live: in the EU, see the EDPB list of authorities; in the UK, the ICO; in Switzerland, the FDPIC.
- One contactEvery data protection request goes to legal@mainstar.ai.
Legal bases and roles
- Running your spaceContract, or our legitimate interest in serving the organisation that uses it.
- Security, abuse prevention, quality scoresLegitimate interest.
- Evaluation and trainingLegitimate interest, after a documented balancing assessment; open to objection.
- Legal obligationsLegal obligation.
- RolesFor personal accounts Mainstar is controller. In organisation spaces the organisation is controller of its content and we process it on its instructions under our Data Processing Agreement, which forms part of the Terms on acceptance.
- TransfersYour space and backups stay in the Netherlands. For US providers we use the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the provider takes part, and otherwise standard contractual clauses.
Compliance roadmap
05 · PLANNEDNone of these is done. We show no badge for a standard we have not met, and no date we have not set.
- SOC 2 Type IIPlanned
An independent audit of our security controls. We are not SOC 2 audited or certified today.
- ISO/IEC 27001Planned
A certified information security management system. We hold no ISO certificate today.
- Independent penetration testPlanned
A test by an outside firm, with a summary published here. None has been done yet.
- EU and UK representativePlanned
GDPR Article 27 and UK GDPR may require a company outside Europe to name one. We have not appointed one yet. Every request goes to legal@mainstar.ai.
- Vulnerability disclosure policyPlanned
Published rules and response times for security reports. The address already works: security@mainstar.ai.
- Breach exercisePlanned
A full rehearsal of the breach procedure, including a failed notification and a handover.