Security
What is true about the hosted Bike4Mind service today, and how to ask for what your review needs.
Your data
No AI training on your content
Bike4Mind does not use your content or your usage to train or improve AI models.
Model providers
Prompts you send to a third-party model (OpenAI, Anthropic, Google and others) are processed under that provider's API terms, which exclude training on your content. Open-weight models you self-host involve no third party at all.
Content-free telemetry
Our product telemetry records how features are used. It never includes your conversations or files.
Where it runs
The hosted service runs on AWS in the United States.
Export and deletion
Export your notebooks from your profile at any time. When you delete your account or data, Bike4Mind deletes it right away and does not retain it. To request deletion, email support@bike4mind.com.
Account security
Multi-factor authentication
Turn on MFA with an authenticator app or a passkey, with backup codes for recovery.
Active sessions
See every device signed in to your account and sign out any of them, or all but the one you are using.
Single sign-on
Sign in through Okta, or through another SAML 2.0 identity provider set up for your email domain. Contact us to connect yours.
Run it yourself
Self-host the full source
Deploy Bike4Mind in your own AWS account with your own model keys. Your data never touches our servers, and you operate the controls and keep the audit trail.
Sub-processors
These vendors process data for the hosted service. Model vendors receive your data only when you pick one of their models.
| Vendor | Data | Purpose |
|---|---|---|
| Amazon Web Services | All service data | Hosting, storage and compute. Region: US (us-east-2, Ohio). Also AWS Bedrock for model inference, Amazon Transcribe for speech-to-text, Amazon Rekognition for image analysis, and Amazon SES for email delivery. |
| MongoDB Atlas | Account and workspace records | Primary database. Region: US (us-east-2). |
| Amazon SES / Google Workspace | Email address and message content | Transactional and account email (sign-in codes, notifications) |
| Anthropic, OpenAI, Google (Gemini API), xAI, Moonshot AI (Kimi), DeepSeek | Prompts, attached files and outputs, only when you pick one of their models | Model inference. Also OpenAI for images and realtime voice, and xAI for image and video generation. |
| Black Forest Labs | Image prompts | Image generation |
| Voyage AI | Text from uploaded files | Embeddings for search |
| ElevenLabs | Text and audio | Voice, sound and music generation |
| SerpAPI | Search queries | Web search tool |
| Firecrawl | URLs you ask it to read | Web page fetching |
| Stripe | Payment and billing details | Payments |
| MailerLite | Email address if you subscribe | Newsletter |
| Google Analytics, Reddit, Meta | Usage and conversion events, per your cookie choices | Analytics and ad measurement |
| BigDataCloud | Location coordinates, only if you use the location lookup in your profile | Reverse geocoding |
Integrations you connect yourself (Google Drive, GitHub, Slack, Notion, Atlassian) and your own identity provider receive data only under your own account with them.
Last updated: October 13, 2026. We will update this list when it changes.
Need a DPA? Email legal@bike4mind.com.
Security reviews and reports
For a vendor questionnaire or security review, email security@bike4mind.com with what you need and your deadline.
To report a vulnerability, follow our security policy or email the same address. Our security.txt lists both.