Trust

Security & Compliance

Last updated: 13 October 2026. Your privacy and data security are our top priorities. Mondaily is built to meet GDPR and CCPA requirements. Our application hosting and database infrastructure is provided by Vercel and Supabase, each of which states that it holds a SOC 2 Type 2 attestation and ISO 27001 certification.

Sovereign-first AI architecture

Mondaily is built on a sovereign-first AI architecture. sōtem, our AI, and web search never send your data to a third-party AI vendor, the application is hosted in Europe, and your data is workspace-isolated: every AI request is scoped to your workspace and can't read another's.

  • Source-backed AI answers, with human-approved agent actions: agents prepare, you approve
  • No fallback to third-party AI providers, ever; your data isn't used for training unless you explicitly approve it
  • Google (Gmail and Google Calendar) is an optional, client-authorized integration: email and calendar data is accessed only after you connect an account, stays workspace-scoped, and can be disconnected any time; it is not core AI infrastructure
  • Stripe is our payment processor: card numbers live with Stripe, never stored by Mondaily, and are never accessible to AI tools

GDPR compliant architecture

We process personal data in line with the EU General Data Protection Regulation. This includes:

  • A clear legal basis for any data we collect
  • Full account and data deletion on request
  • Data portability: export your records at any time
  • Data Processing Agreements (DPA) available for enterprise customers

CCPA data protected

For California residents, Mondaily does not sell personal information. You have the right to:

  • Know what personal data we hold about you
  • Request deletion of your personal data
  • Opt out of any data sale (we do not sell data)

Hosting infrastructure & sub-processors

These third parties process customer data on Mondaily's behalf. What each one receives and when it is used is on our DPA page; both pages are drawn from the same list.

No AI vendor processes your data. sōtem (AI), web scraping, transcription and embeddings are built to run only on servers Mondaily operates. Until those servers are in service, these features are not available; it never falls back to a third party. sōtem Radar looks businesses up in the public data sources listed below, sending them search words only.

Core platform: hosted in the EU (Frankfurt)

Mondaily runs the application and stores your data in the EU (Frankfurt), on infrastructure from these two providers.

  • Vercel: Hosting for the web app, the API and this website.

    Where: EU: the API runs in Frankfurt (fra1); public web pages are cached on Vercel's global edge network.

  • Supabase: Database and file storage, including call recordings.

    Where: EU: Frankfurt.

Temporary providers (planned to be replaced)

We plan to replace each of these with a service Mondaily runs itself. Until then they are in use as described here. When we switch, we run ours in parallel first, switch over, then turn theirs off.

  • Inngest (Inngest Cloud): Runs background jobs: scheduled agents, record enrichment, reminders.

    Where: Inngest's cloud; region set by the provider, may be outside the EU.

    Plan: Our own job runner on a Mondaily server (a configuration switch, run in parallel first).

  • Resend: Delivers account and notification email, and email your workspace sends.

    Where: Resend's cloud; region set by the provider, may be outside the EU.

    Plan: A mail server Mondaily runs itself; Resend stays as a fallback while its reputation warms up (2–4 weeks), then is removed.

  • LiveKit (LiveKit Cloud): Real-time audio and video for calls; records a call when someone in it starts recording.

    Where: LiveKit's cloud; calls connect through servers near the participants, which may be outside the EU.

    Plan: Our own LiveKit and TURN servers, after a test week.

  • Google Maps Platform (Places API): Business lookups for sōtem Radar and record enrichment.

    Where: Google's cloud; region set by the provider, may be outside the EU.

    Plan: OpenStreetMap and our own search, once match rates are compared.

  • OpenStreetMap Nominatim (public service): Open-data business and address lookups for sōtem Radar.

    Where: The OpenStreetMap Foundation's public servers.

    Plan: Our own Nominatim server.

Optional: only when you choose it

Nothing is sent unless you sign in with or connect the account yourself; you can disconnect at any time.

  • sōtem Voice engine (run by Mondaily, not a third party): Text to speech, speech to text and the other sōtem Voice models, run by Mondaily, no outside AI provider.

    Where: Not in use yet: no voice data is processed here today. Its location is listed here before any is.

  • Google (Sign in with Google, Gmail, Google Calendar): Optional sign-in with Google, and the optional Gmail and Google Calendar connector.

    Where: Google's cloud; region set by the provider.

  • LinkedIn: Optional LinkedIn connection: sign in with your own LinkedIn account and publish posts you approve.

    Where: LinkedIn's cloud; region set by the provider.

  • X: Optional X connection for sōtem Social: publish posts you approve.

    Where: X's cloud; region set by the provider.

  • Meta (Facebook, Instagram, Threads): Optional Facebook Page, Instagram and Threads connections for sōtem Social: publish posts you approve.

    Where: Meta (Facebook, Instagram, Threads)'s cloud; region set by the provider.

  • TikTok: Optional TikTok connection for sōtem Social: publish videos and photos you approve.

    Where: TikTok's cloud; region set by the provider.

  • Google (YouTube, Business Profile): Optional YouTube and Google Business Profile connections for sōtem Social: publish uploads and updates you approve.

    Where: Google (YouTube, Business Profile)'s cloud; region set by the provider.

  • Pinterest: Optional Pinterest connection for sōtem Social: publish pins you approve.

    Where: Pinterest's cloud; region set by the provider.

  • Telegram: Optional Telegram channel connection for sōtem Social: publish posts you approve through Mondaily's bot.

    Where: Telegram's cloud; region set by the provider.

  • Bluesky: Optional Bluesky connection for sōtem Social: publish posts you approve.

    Where: Bluesky's cloud; region set by the provider.

  • Mastodon (your chosen server): Optional Mastodon connection for sōtem Social: publish posts you approve on the server you choose.

    Where: Mastodon (your chosen server)'s cloud; region set by the provider.

  • Snapchat: Optional Snapchat connection for sōtem Social (only after Snap grants partner access): publish stories you approve.

    Where: Snapchat's cloud; region set by the provider.

  • PayPal: sōtem Data Lab: paying contributors for approved work.

    Where: PayPal's cloud; region set by the provider.

Payments: Stripe, we never see or store card numbers

Used only when you buy something.

  • Stripe: Payment processing.

    Where: Stripe's cloud; region set by the provider.

Public data sources (sōtem Radar)

sōtem Radar finds companies in public, openly licensed data. These services are not sub-processors: they receive only search words (an industry, a city or country, a date range, or a company's public job board name), never your records, contacts or any personal data. We show each source's credit next to the results it gave.

  • OpenStreetMap (Overpass and Nominatim)

    Receives: An industry category and a city area or place name.

    We take: Business names, addresses and website links from the open map.

    Licence: Open Database License (ODbL 1.0); credit: © OpenStreetMap contributors. Terms

  • TED, the EU's public tenders journal

    Receives: A procurement category code, a country and a date range.

    We take: Open calls for tender: buyer, title, dates and the notice link.

    Licence: EU open data, free reuse with credit (Commission Decision 2011/833/EU); credit: Source: TED. Terms

  • GDELT news index

    Receives: Industry and place words.

    We take: Links, headlines and dates of public news about funding or expansion.

    Licence: Free reuse with citation; credit: News index: The GDELT Project. Terms

  • Wikidata

    Receives: A country.

    We take: Organisation names and their official websites.

    Licence: CC0 1.0 (public domain); credit: Data from Wikidata. Terms

  • Greenhouse and Lever public job boards

    Receives: The public job board name a company links from its own careers page.

    We take: Open role titles, locations and links the company published.

    Licence: Public job-board APIs, no account needed; the company's own published postings. Terms

  • Google Places (optional paid extra)

    Receives: Search words (an industry and a place). Google is a vendor and receives these words; it never receives your records.

    We take: Optional and never required: only after the free sources, while our own search is offline, within a daily budget, and only while Google answers. The place ID (the only part we keep) and a business's website link.

    Licence: Google Maps Platform terms; credit: Google Maps. Terms

  • Brave Search (only if switched on)

    Receives: Search words only, with private details (emails, phone numbers, ids, bank and card numbers) removed first: backup for sōtem Radar and for sōtem chat web search and research, only while Mondaily's own web search is not available and the workspace allows it.

    We take: Links to public web pages; no results are kept.

    Licence: Brave Search API terms. Terms

This page is the current list. We add a provider here before it receives any customer data, and the "Last updated" date changes with every change. Customers with a signed DPA can ask privacy@mondaily.com for the list at any time.

For the current status of Vercel's and Supabase's certifications, see vercel.com/security and supabase.com/security.

Questions

For security or compliance questions, including data deletion requests, contact privacy@mondaily.com.