Trust center
How we handle the files you send us.
Mighty is deployed in your environment for the documents your underwriting and claims systems depend on. This is how we divide security responsibilities and what your team can review before production use.
Compliance review
On request during procurement
SOC 2 Type II
In progress
Responsible disclosure
hi@trymighty.ai
Deployment diligence
Confirmed before go-live
Last updated: August 19, 2026
01The controls
What a security reviewer wants to see, in one place.
The controls below are the ones procurement and risk teams ask about most. We document Mighty's controls and the customer's production responsibilities so diligence moves faster.
Encryption
Mighty supplies supported secure configuration and documents encryption requirements. The customer operates and verifies transport and storage protections in its production environment.
Data isolation
The application provides organization-aware boundaries. The customer controls the production network, identity, project or account boundaries, and environment isolation.
Customer-controlled retention
The customer configures production storage, logs, backups, retention, and deletion. Mighty does not receive Customer Content through the supported default deployment path.
Access control
Mighty supplies application authentication and role capabilities. The customer controls production identities, access approval, MFA, secrets, key rotation, and revocation.
Vulnerability management
Sensitive code paths are reviewed before release. Automated dependency, static-analysis, and secret scanning run on every change, and fixes are prioritized by severity and customer impact.
Compliance review
Security, data-handling, and deployment posture are documented and walked through with your team during procurement, not asserted on a page.
02Data handling
Your production data plane stays under your control.
Enterprise Private Deployment runs in your cloud or data center. Mighty receives Customer Content only through a separately authorized support or other contracted channel.
With your data, we
Do this
- Build, test, package, and document supported software releases
- Document the supported private-deployment security baseline
- Provide vulnerability and update information for supported versions
- Use an authorized, logged, and time-bounded path when support access is approved
- Review deployment responsibilities with your team before production use
And we never
Do this
- Export production Customer Content to Mighty through the supported default path
- Train shared or general-purpose models on Customer Content by default
- Deploy an update into your production environment without customer authorization
- Enable ongoing remote support access without customer approval
- Treat a development or evaluation environment as customer production
Deployment-specific controls are confirmed in writing during security review.
03Where it runs
Deployed where your documents already live.
The customer selects and operates the production environment. Mighty supplies supported deployment artifacts, security guidance, release information, and contracted support. The exact boundary is recorded in the Order and deployment documentation.
Customer-operated boundary
Customer controls production network segmentation, identity, keys, monitoring, retention, backups, and deployment approval.
Reviewed before go-live
Mighty and Customer document the supported version, responsibilities, support path, and security requirements before production use.
04Responsible disclosure
Found something? Tell us first.
We welcome responsible disclosure from the security community. Report a vulnerability to hi@trymighty.ai and we'll acknowledge it promptly and work with you to resolve it.
Machine-readable: /.well-known/security.txt
What to include in a report
- Description of the vulnerability and its potential impact
- Steps to reproduce the issue
- Any proof-of-concept code or screenshots
- Your contact information for follow-up
What we ask of researchers
- Give us reasonable time to investigate and fix before public disclosure
- Do not access, modify, or delete data belonging to other users
- Do not perform actions that could impact service availability
- Do not use automated scanning tools that generate excessive traffic
What we commit to in return
- Acknowledge good-faith reports promptly
- Provide regular updates on our progress
- Credit you in our security acknowledgments (if desired)
- No legal action against good-faith security researchers
05Security updates
Material changes, communicated.
We notify customers of material security updates that affect supported software and contracted support. Critical fixes are prioritized by severity, exploitability, and customer impact. Customers control production rollout unless the Order says otherwise.
On your files
See what your intake is already missing.
Bring a sample from live intake. We'll walk the edits and fakes your reviewers and automation miss, before they reach a decision.