Security & Trust
Trust begins with boundaries.
A system that works with your company's information should know exactly what it may see, what it may do, and when it must stop. Here are the boundaries Mingjian operates within — and a transparent account of our certification status.
01The short version
Confidence, in four honest tiers.
Most security pages blur what is built, what is promised, and what is planned. Ours separates them, because a diligence review will anyway:
Agreed access. Read-only first. Permissions your company sets. A named person approves every consequential action. Sources on answers. A durable, attributable record. Access you can revoke. These are implemented in the product you would see demonstrated — detail in the boundary rules below.
Hosting region, model providers and their data-processing terms, retention windows: configured per customer and confirmed in writing for each deployment before anything connects.
SOC 2 and ISO 27001 are not held. Documented practices stand in until certification exists — and we will tell you plainly in the first conversation, either way.
Data ownership, exit, return, and deletion are commitments in the agreement, drafted with counsel — effective when signed, not marketing claims.
02Boundaries
Eight rules the system operates under.
Mingjian sees only the systems, documents, and mailboxes you approve — limited to what the chosen process needs. Nothing broader.
Connections start read-only. Acting through a system — sending an email, updating a record — is a separate capability, switched on only where you decide.
What Mingjian may read and what it may do is defined by your company and enforced by the system — never by the AI's own judgment.
When something matters — an email sent, a record changed, an order placed — a named person approves the exact action first. Approval and action are separate steps, and both are recorded.
Results show what supports them. A claim without its evidence is not presented as an answer.
Approvals, actions, results, and verifications are recorded and attributable. The record is not rewritten.
If a source is unavailable, the affected work is flagged — a blind check is never reported as all clear.
Access is granted by you and can be removed by you, at any time. Removing a connection stops the capability at the boundary you control.
03Data Handling
Your data, handled within its limits.
- Customer data belongs to the customer. Company information is processed to run the processes you choose — not for advertising, not reused across customers.
- Processing is disclosed. Which systems are read, what the AI does with them, and which model providers are involved under what terms — stated in writing for each deployment.
- The record is yours. Information, results, decisions, and approvals are exportable; on exit, data is returned and deleted with written confirmation.
04Certifications
Where we stand, transparently.
Certifications matter, and we do not pretend otherwise. Today, Mingjian does not hold SOC 2 or ISO 27001, and we claim no GDPR or PDPA certification. Rather than stretch the truth, here is exactly what we do instead — and we will publish evidence as it exists.
| Framework | Status | What we do today |
|---|---|---|
| SOC 2 | Not held | Documented practices, agreed access limits, approval logs, and a written security overview shared with customers during procurement. |
| ISO 27001 | Not held | The same documented practices; certification only when evidence exists. |
| GDPR / PDPA | No certification claimed | Data-processing terms drafted with counsel; processing disclosed per deployment; individual-rights requests honored. |
If your review process requires a certification we do not hold, we will tell you plainly in the first conversation — and support your decision either way.
Responsible disclosure.
Found something? Tell us. We will acknowledge, act, and tell you what we did.
Confidential security package
For qualified buyers entering procurement or technical diligence, we provide a confidential security package covering access controls, data flow, retention, and deployment boundaries in structured detail.
This package is shared under need-to-know controls after an initial conversation establishes fit. It is not published on this website.