Skip to content
MentionRadar

Security and data handling

MentionRadar encrypts data in transit and at rest, keeps each workspace separate, gives you roles and retention controls, offers SSO with SAML and an audit log on Enterprise, and signs a GDPR data processing agreement. This page explains each control in plain language.

Scan my brand See plans from $24 a month
  • TLS for every connection
  • Encrypted storage and backups
  • Roles, audit log and SSO
  • Data processing agreement on request

What we protect, and how

Encryption in transit

Every page, API call and webhook uses TLS 1.2 or newer. Plain HTTP requests are redirected to HTTPS and the site sends a strict transport security header.

Encryption at rest

Databases, file storage for reports and backups are encrypted at rest. Secrets such as Slack webhook URLs and API tokens are stored with an additional application level encryption layer.

Workspace isolation

Every query is scoped to the team and workspace that owns the data. Agency client workspaces are separate, and client read-only users see only the workspace they are invited to.

Access control

Roles for admin, editor and viewer decide who can change keywords, alert rules, billing and integrations. Two-factor authentication is available on every plan, and Enterprise adds SAML single sign-on.

Audit log

On Enterprise, sign-ins, invitations, role changes, keyword and alert rule edits, exports and API token events are recorded with time, user and IP address, and can be exported.

Payments

Card details are entered on our payment processor's secure checkout page with 3D Secure. MentionRadar never sees or stores full card numbers.

Data we collect and data we never need

Brand monitoring works on public information. The mentions in your feed come from public news pages, blogs, forums, Reddit, Hacker News, review sites, YouTube and X. The AI answers come from asking the AI engines included in your plan the prompts you track, exactly as a buyer would.

That means we never need access to your CRM, your customer database, your ad accounts or your social media logins. The only personal data we hold about your company is the list of users on your account and the people who receive alerts and reports.

Mentions themselves can contain the public username of the person who wrote a post. We store the text and link as published, show it only inside your workspace and delete it when it passes your plan's history window. How the scores built on this data work is described on the methodology page.

Data MentionRadar stores and does not store
Data Stored Purpose
User names and work emails Sign-in, alerts, reports
Keywords, competitors, prompts Running your monitoring
Public mentions and AI answers Your feed and scores
Billing records Invoices and tax
Full card numbers Held by the payment processor
Your social media passwords Never requested
Your customer or CRM data Never requested

Retention, deletion and portability

  1. 1

    History window

    Mentions and AI runs are kept for your plan's history period, 3 months on Starter up to 36 months on Enterprise, then deleted on a rolling basis.

  2. 2

    Export anytime

    CSV export of mentions on every plan, PDF reports on Growth and up, and the API on Agency and Enterprise.

  3. 3

    Delete on request

    Owners delete a workspace or the account from settings. Deletion is immediate in the app and backups roll off within 30 days.

  4. 4

    After cancellation

    Data stays available until the paid period ends, then the account moves to read-only for 30 days before deletion.

GDPR, processors and Enterprise controls

For customer account data, MentionRadar acts as a processor on your behalf and offers a data processing agreement based on the GDPR standard terms. We use a small set of subprocessors by category: infrastructure hosting in the European Union, a payment processor, an email delivery provider and the AI engines that answer tracked prompts. Each is bound by a written agreement and receives only the data it needs.

Enterprise adds the controls procurement teams ask for: SAML single sign-on with enforced login, unlimited seats with role management, an audit log, a 99.9 percent monthly uptime commitment, invoice billing on yearly plans and the full API with signed webhooks. All of it is available from the pricing page with self-serve checkout.

Security questionnaires and DPA requests go to [email protected]. We answer standard questionnaires in writing.

Questions from security reviews

What data does MentionRadar store about my company?

Your account details (names and work emails of users), the keywords, competitors and prompts you configure, the public mentions and AI answers collected for them, alert settings, reports and billing records. We do not need access to your own systems, social accounts or customer data to monitor public mentions.

Is my data used to train AI models?

No. Your configuration, mentions and reports are not sold, shared for advertising or used to train models. Prompts are sent to the AI engines you track only to read their public answers, the same way a person would ask them.

Do you sign a data processing agreement?

Yes. Any paying customer can request our GDPR data processing agreement by writing to [email protected] from an account owner address. Enterprise customers can also review the list of processor categories and security measures before purchase.

How long do you keep data?

Mention history is kept for the period your plan includes (3, 12, 24 or 36 months) and then deleted on a rolling basis. Account owners can delete a workspace or the whole account at any time. Backups roll off within 30 days of deletion.

Do you support single sign-on?

Enterprise includes SSO with SAML 2.0 for identity providers such as Okta, Microsoft Entra ID and Google Workspace, plus an audit log of sign-ins and configuration changes. Every plan supports two-factor authentication for user accounts.

How do I report a security issue?

Email [email protected] with the subject "Security". Include steps to reproduce. We acknowledge reports within two business days and keep you updated until the issue is fixed.

Review the product with your own brand

A scan needs only a brand name, no access to your systems. Run one now and share the result with your security reviewer.

Scan my brand Compare plans