Mnemone was designed with security as a primary architectural constraint.
This document describes how we protect the infrastructure, how we isolate data, and the principles applied in our engineering decisions.
Zero-Trust Model
No component of Mnemone's internal infrastructure is directly exposed to the internet. All inbound traffic routes through a distributed network of edge proxies that handles cryptographic termination (strictly TLS 1.3 with HSTS) and proactive threat filtering.
This means DDoS attacks or automated scanning attempts are neutralized well before they can ever reach the application servers. Communication between the network perimeter and our internal workers takes place through dedicated encrypted tunnels, making compute nodes invisible to public scans.
Air-gapping
The database is clearly the heart of the platform, and we apply a strict segregation policy. Database clusters reside exclusively on internal private virtual networks without public gateways.
No external connection can reach the databases, even with valid credentials. Access is granted solely to authorized internal microservices. Furthermore, internal analytics and reporting tools run on separate instances and access learning data strictly through read-only roles.
Access Management
On the operational front, we apply the principle of least privilege at every level:
- Administrative access to servers is granted solely via dedicated personal cryptographic keys, with strict limits on handshake attempts.
- Continuous log analysis systems identify anomalous behaviors or scanning attempts, triggering immediate firewall-level blocks.
- Production runtimes are configured to allow timely patching of kernel and operating system security updates without interrupting active study sessions or restarting application containers.
Supply Chain
A solid infrastructure is useless if the software contains logic flaws. For this reason, every single code change is automatically verified within our pipeline before it can ever reach the production environment.
We run AST scans to intercept insecure patterns, verify type compatibility across the frontend, and compile dependencies daily against CVE databases.
Privacy by Design
Mnemone is a platform built for students, not an advertising service. Personal data is processed in full compliance with GDPR:
- All servers, databases, and backups are physically located within the European Economic Area (EEA).
- We do not use advertising pixels, commercial profiling trackers, or invasive monitoring tools.
- You can export your questions or request the permanent deletion of your account and all associated records at any time.
Vulnerability Reporting
If you have identified a potential security issue or would like clarification regarding our practices, you can contact the technical team directly at [email protected]. We read every message and commit to providing an initial response within 24 hours.