Trust, Security & Data Privacy.

Primary server workloads and encrypted databases run in certified European data center facilities (Germany & Finland) with ISO/IEC 27001 physical and biometric security controls.

Global traffic is routed through Cloudflare's edge network, providing automatic DDoS protection, Web Application Firewall (WAF) rule sets, and bot mitigation.

Continuous automated static code analysis, third-party dependency vulnerability scanning, and container verification run in every CI/CD deployment pipeline.

Real-time performance monitoring and anomaly alerting across all microservices and database nodes with on-call engineering rotations and 99.98% operational uptime target.

Automated continuous point-in-time database backups replicated to secondary disaster recovery facilities with tested RTO < 4 hours and RPO < 15 minutes.

Database clusters and internal backend services reside inside private subnets without public IP addresses, accessible only via authenticated internal API gateways.

Internal team access to infrastructure and production systems is strictly restricted based on business need and role-based permissions (RBAC) with quarterly access reviews.

Multi-Factor Authentication (MFA / 2FA) is mandatory for all internal accounts, repositories, and cloud dashboards with FIDO2 / hardware security key enforcement.

All team members undergo background verification prior to onboarding and complete mandatory quarterly data security, phishing defense, and privacy compliance training.

All administrative access, configuration updates, and infrastructure changes generate tamper-resistant audit logs stored in append-only write-once cloud storage for 365+ days.

Every subprocessor and third-party vendor undergoes strict security assessment, DPA execution, and annual compliance re-certification before connecting to our systems.

Formal incident response procedures with predefined severity levels, executive escalation, forensics guidelines, and regulatory breach notification within 72 hours.

Mindful Slumber operates a freemium and subscription business model. We do not sell, rent, or monetize your personal practice history, sleep notes, or audio journals.

For corporate partners and wellbeing programs, employers receive exclusively aggregated, k-anonymized summaries. Employers never see individual dream logs, sleep scores, or notes.

You own your dream journals and meditation records. Users can export their complete archive in open machine-readable JSON format at any time directly from account settings.

Reverie AI dream analysis is executed under zero-data-retention APIs. Private journal reflections and user dream texts are never used to train public foundation models.

HealthKit access is completely optional. Permission is requested explicitly with transparent category breakdowns and can be revoked instantly in device settings.

Users can permanently delete their account, sleep records, and journal archives with a single self-serve action without having to email customer support.