Show any client exactly how the work was done.
One governance layer runs under every Stackmint operating system. This page sets out its controls, how your data is handled, and the documents your clients and regulators ask for.
Six controls under every OS.
AgencyOS, LegalOS and every Custom OS inherit the same controls. They are part of the platform, not settings a team can forget to switch on.
Human approval before anything reaches a client
Nothing reaches a client until a named person approves the exact version.
named person · exact versionImmutable, granular audit logs
Every request, decision, change and result is recorded. Answer any client or regulator with evidence.
request · decision · change · resultKill switches
Stop any agent or workflow at once.
run · workflow · org levelExecution gateway
Agent actions run through a controlled gateway, with credentials kept server-side.
credentials kept server-sideVersioned agents
Each agent, playbook and model version is pinned. No silent changes to how work gets done.
agent · playbook · model pinnedClient data isolation
Every client and matter has its own context. Documents are treated as content, never as instructions.
per client · per matter
Where your data lives and who can touch it.
Each fact below is stated in our legal documents and links to its source.
- Hosting
Core runtime and control-plane services run in the United States or the European Union, depending on architecture and customer requirements.
Data residencySubprocessors- Encryption
TLS in transit. Encryption at rest for databases and storage where supported.
Security overviewDPA- Access
Role-based access controls and least-privilege access. Access to production data is limited and audited.
DPASecurity overview- Credentials
Integration credentials are held in secrets management.
DPA- AI model providers
Used only where the customer explicitly enables them: OpenAI, Mistral AI, Hugging Face, Anthropic or others the customer configures. Many offer regional options, such as EU-hosted inference.
SubprocessorsData residency- Model training
Stackmint does not use customer data to train proprietary foundation models. Any use for fine-tuning or evaluation requires explicit agreement.
AI governance- Deletion
On termination or written request, personal data is deleted or returned, unless retention is required by law or for business records, such as limited backups during a defined retention period.
DPA- Transfers
Transfers of EU, UK or Swiss personal data to a third country use Standard Contractual Clauses or other recognized safeguards.
DPA- Incidents
Affected customers are notified without undue delay, in line with contractual and legal requirements.
DPASecurity overview
Built for firms that answer to regulators.
The documents clients ask for.
More detailed documentation and responses to security questionnaires are provided to customers under NDA.
Data Processing Agreement
How Stackmint processes personal data on your behalf.
/dpaSubprocessors
Every third party we use, what for and where.
/legal/subprocessorsData residency
Where data is processed and how to choose a region.
/legal/data-residencyAI governance
Logging, transparency and how customer data is used.
/legal/ai-governanceSecurity overview
Infrastructure, data protection and incident response.
/legal/securityGDPR
Our role and commitments as a processor.
/legal/gdprPrivacy policy
What we collect, why, and your rights.
/privacyTerms of service
The terms that govern use of Stackmint.
/terms
Security question or questionnaire to complete? Contact us