Mindset for your security review

The answers your security or procurement team will ask for, each linked to the page with the detail.

Send this page to whoever reviews Mindset for security or procurement. For how one compliance posture covers every agent, see Compliance.

The answers#

Question	Answer	Detail
Where does our data live?	On the Mindset deployment your org is created on, in a region fixed at creation. Or in your own AWS account, run by your own team	Where your data goes and Host it yourself
Which AI providers see it?	The one whose key your org sets: Anthropic, OpenAI or AWS Bedrock. Knowledge is embedded with OpenAI	Use your agents from AI clients
How are passwords and keys for our systems kept?	In a secret store. They never reach the agent or the AI model	Security and approval
What can an agent reach?	Only the actions your team has named, called operations. There's no general web access	Connections and operations
Who decides what an agent may change?	A person, or an org setting, approves each action that changes another system, once. No agent can approve	Security and approval
Is there a record?	Every action and every AI model call is recorded. The record can't be edited or deleted, and each entry is chained to the one before, so a change would show	Audit and personal data
What about personal data?	It can be replaced with placeholders before it reaches the AI provider	Audit and personal data
Are test and production kept apart?	Yes. Each environment has its own agents, connections and keys, and a key works only in its own	Environments

Default	Change it if
New actions that change other systems are switched on automatically	A person should approve each one. Settings → Systems
Personal data protection is off	Personal data must not reach the AI provider. Settings → Governance
Mindset's own building agents use Mindset's AI keys	Every AI call must go through your accounts. Turn on Run the built-in agents on our own key

Every setting and its default is on Org settings.

Set a spending cap.
Keep Anthropic or OpenAI calls in one region. On AWS Bedrock, calls stay in the region your org chooses when the model is served there.
Run behavior tests automatically before a change goes live.
Tell your other systems which agent called them. They see the connection's shared credential, and Mindset's audit record names the agent.