Trust
Where the data comes from, and where it lives.
Mandate is early. This page says plainly how it runs today, what it keeps, who else can see it, and what is not in place yet. If your compliance team has a questionnaire, send it over and it will come back answered.
Last updated 28 September 2026
01
What Mandate reads
Public pages that firms publish about themselves: team and people pages, individual profiles, practice pages and news. Nothing behind a login.
To find firms it has not been given, it can run a web search through a search provider. Everything it keeps still comes from a public page it read.
It does not scrape LinkedIn, log in anywhere, read private systems or buy contact data.
02
What it keeps
| About | What is kept |
|---|---|
| People found in research | Name, job title, firm, office, practice area, the page they came from and the date it was read, any LinkedIn link the firm itself published, and Mandate's note on why they matter. Any email address or phone number the firm published, marked as published, or a best-guess address marked as a guess. |
| Your work | Your notes, pipeline stages, follow-up dates, briefs and review decisions. |
| Your account | Name, work email and a salted, hashed password. Sessions expire after 12 hours. |
| Security records | An audit log of material actions, such as sign-ins, exports and changes to settings, with the IP address and browser used. |
You can export your workspace at any time. When you leave, ask and it is deleted; backup copies roll off within 30 days.
03
Where it lives
Pilot workspaces run on one Windows laptop that I own and run in London. It is not a data-centre server. Traffic reaches it through Cloudflare, which provides the HTTPS connection and passes requests through an encrypted tunnel. Saved provider credentials are encrypted with AES-256-GCM.
Inside the app each user's research, pipeline and briefs are their own. A separate workspace for your firm can be set up on request.
This is a founder-run service at an early stage, not an enterprise hosting arrangement. The exact set-up for your trial is written into the pilot agreement before you start.
04
Who else can see it
| Provider | Why | When |
|---|---|---|
| Cloudflare | Network edge and HTTPS. It handles the traffic between your browser and the server. | Always |
| Resend | Password resets and other account emails. | When an email is sent |
| Tavily | Web search, used to find firms. It receives the search query, which can include what you type when you describe a market. | When a search runs |
| Firm website icons. The server asks Google's icon service for each firm's web address; no names are sent. | When a new firm is shown | |
| Microsoft 365 | Drafts in your own Outlook and meeting invites. | Only if you connect it |
The app's optional AI features are switched off, so the app sends nothing to an AI provider. I build and maintain Mandate with AI coding assistants that run on the same laptop, so they could reach the stored data. Keeping customer data out of their reach is on the list below.
05
What is not in place yet
| Item | Status |
|---|---|
| Backups | Partly Nightly backups, kept for 30 days on the same laptop. Restore last tested 22 September 2026. No off-site copy yet. |
| Hosting away from the development laptop | Not yet Customer data will move to a separate UK host, out of reach of development tools, before the first paid customer. |
| Multi-factor sign-in inside the app | Not yet |
| External penetration test | Not yet |
| SOC 2 or ISO 27001 | Not held No date is promised. |
| 24-hour support | Not offered Support is by the founder in UK business hours. |
| Professional indemnity and cyber insurance | Not yet |
| Supplier | Sole trader Conor Hannon-Healy, trading as Mandate. No limited company yet. |
If any of these is a hard requirement for your firm, say so at the start. It is better to know before a trial than after.
06
Paperwork
Draft pilot terms, a draft data processing agreement and a security overview are available on request, and are finalised with you before a trial. Email conor@mandates.cc.
If you are named in a brief, or you have been contacted about Mandate, the privacy notice explains what is held and how to have it removed.