Privacy Policy

Last updated: October 12, 2026

Introduction

Welcome to Evident. This Privacy Policy explains how TrstMnd, Inc., a Delaware corporation doing business as Evident ("Evident", "we", "us", or "our"), collects, uses, shares, and protects information in relation to our software-as-a-service platform designed to help automate responses to security questionnaires (the "Service"). This policy applies to visitors to our website trustmind.com and registered users of the Service (collectively, "Users" or "you").

Your privacy is important to us. By using our Service, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. Please read this policy carefully. If you do not agree with this policy, please do not access or use the Service.

This Privacy Policy does not apply to the data processing practices of our customers ("Customers"), who use our Service to manage their own security questionnaire responses. Our Customers are responsible for their own privacy policies governing the data they control.

Data Processing Agreement. Evident offers a public Data Processing Agreement (DPA) that automatically applies to Customers whose use of the Service involves the processing of Personal Data, including to support GDPR, UK GDPR, and CCPA obligations. Customers who require a countersigned copy for their records may request one by contacting privacy@evident.security. Where Evident processes Personal Information on behalf of a Customer under the DPA, the terms of that DPA control over any conflicting provision of this Privacy Policy regarding such processing.

No Model Training on Customer Data. Evident does not use Questionnaire Content, prompts, or any outputs generated from Customer data to train, fine-tune, validate, update, improve, or modify any artificial intelligence or machine learning model, including any third-party large language model. This prohibition applies regardless of whether the data is identified, de-identified, or aggregated. Beyond providing, operating, and debugging the Service, the only planned additional use of Customer data is the generation of aggregated, irreversibly de-identified benchmarking insights described under "Benchmarking" below, which is a future feature not yet launched. Our full commitment is set out in our Terms of Service.

What Information We Collect

We collect information to provide and improve our Service. The types of information we collect depend on your interaction with us:

Information You Provide Directly

Account Information: When you register for an account, we collect your first and last name, business email address, and your company name. We use this to create and manage your account and facilitate login.

Questionnaire Data: To use the core functionality of the Service, you will upload files containing security questionnaires and potentially the corresponding answers or related documentation ("Questionnaire Content"). You are responsible for the content you upload. While the primary purpose is not to process personal information within this Questionnaire Content, it could inadvertently contain personal data depending on what you choose to upload. We process this data solely to provide the Service as instructed by you or your organization.

Internal Routing Information: Your organization's administrator may associate your user account internally with specific topics or areas of expertise (e.g., 'legal', 'engineering') to help route specific questionnaire items within the Service.

Communications: If you contact us directly (e.g., for support or inquiries via support@evident.security), we may collect your name, email address, and the contents of your message.

Information Collected Automatically

Usage Data: When you use the Service or visit our website, we automatically collect information about your interaction and device using tools like PostHog. This may include your IP address, browser type, operating system, device identifiers, pages viewed, features used, actions taken within the platform, referring URLs, and timestamps. We do not send Questionnaire Content to our product analytics providers; only usage events and telemetry metadata are sent.

Cookies and Similar Technologies: We use cookies (small text files stored on your device) and similar tracking technologies to operate and administer our Service, gather usage data, and manage preferences. We use:

• Essential Cookies: Necessary for the Service to function (e.g., authentication, security).
• Analytics Cookies (e.g., PostHog): Help us understand how Users interact with the Service so we can improve it.
• Marketing Cookies: We plan to use marketing cookies to help us promote our Service. You will be able to manage your preferences for non-essential cookies. (Further details in the section titled Your Rights and Choices).

How We Use Your Information

We use the information we collect for various purposes, including:

Providing and Maintaining the Service: To operate the Evident platform, authenticate users, process your Questionnaire Content to automate responses, and fulfill our contractual obligations to our Customers.

Internal Routing: To facilitate the direction of specific questionnaire items requiring manual input to the relevant user within your organization, based on the internal routing information associated with user accounts.

Communication: To send you essential service-related communications (e.g., account verification, technical notices, security alerts, administrative messages) as well as information to help optimize your use of the platform. You may opt-out at any time.

Security and Fraud Prevention: To monitor for and prevent potentially prohibited or illegal activities, enforce our Terms of Service, and protect the security and integrity of the Service and our users.

Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.

How We Share Your Information

We do not sell your personal information. We share information only in the circumstances described below:

Within Your Organization: Information associated with your account, including your name, email, and any internal routing designations, may be visible to others within your company's Evident account to manage users and workflow. Questionnaire Content uploaded by users within your organization is accessible to other authorized users from your organization within the Service.

Integrations: You can connect Evident to third-party services, such as Slack, Microsoft Teams, Google Drive, Confluence, Notion, GitHub, 1Password and Drata. If you choose to connect Evident to such services, we will share information with them, and receive information from them, only as necessary to provide the integration, based on your authorization. The use of information by these third-party services will be governed by their own privacy policies.

Business Transfers: If Evident is involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction as permitted by law and/or contract. The successor entity would continue to be bound by the promises made in this Privacy Policy, or you would be notified of any material changes.

Legal Requirements: We may disclose information if required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect and defend the rights or property of Evident, (iii) act in urgent circumstances to protect the personal safety of users of the Service or the public, or (iv) protect against legal liability. While we consider it unlikely given the nature of the data primarily processed, we will comply with valid legal requests.

Data Security

We take the security of your information seriously and implement technical and organizational measures designed to protect it from unauthorized access, disclosure, alteration, and destruction. These measures include:

Encryption: We use industry-standard TLS encryption for data in transit between you and the Service. Data at rest is also encrypted.

Data Minimization: We strive to collect only the information necessary to provide and improve the Service.

Secure Infrastructure: We leverage the robust security infrastructure and practices of our cloud service providers (e.g., AWS, Cloudflare, Google).

Access Controls: We implement access controls to limit internal access to data based on job function and necessity.

However, please be aware that no security measures are perfect or impenetrable. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security. You are also responsible for maintaining the security of your account credentials.

Data Retention

We retain information for different periods depending on its nature and the purpose for which it was collected:

Account Information: We retain your name, email address, and company name for as long as your account is active or as needed to provide you with the Service. If you request account deletion, we will delete this information subject to any legal obligations or legitimate operational needs (e.g., for audit trails or security logs, often in an aggregated or anonymized form). (Currently, account closure is handled via request to privacy@evident.security).

Questionnaire Content: We retain the Questionnaire Content you upload for as long as your account is active or as needed to provide the Service, including maintaining historical context for answering questionnaires and, in the future, for generating aggregated, irreversibly de-identified benchmarking insights as described above. Authorized users within your organization can delete uploaded Questionnaire Content at any time through the Service interface. Upon deletion by you, the content is removed from our active systems according to our standard procedures.

Usage and Analytics Data: We retain automatically collected usage data and analytics information for as long as necessary for the purposes described in this policy, such as service improvement, security analysis, and reporting. This data may be aggregated or anonymized over time.

We will delete or anonymize your information when it is no longer needed for the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

Your Rights and Choices

Depending on your location and applicable laws (such as GDPR for users in the European Economic Area/UK, or CCPA/CPRA for California residents), you may have certain rights regarding your personal information. We provide you with the following choices and mechanisms to exercise control over your information:

Access and Correction: You can access and update certain account information (like your name and email address) directly through your account settings within the Service. For other requests to access information we hold about you, please contact us.

Data Portability: You may have the right to request a copy of the personal information we hold about you in a structured, machine-readable format. As noted, most substantive data within the service (Questionnaire Content) originates from you, but you can contact us to request data portability.

Opt-Out of Communications: You can opt-out of receiving promotional or marketing emails from us at any time by following the unsubscribe instructions provided in those emails. You will continue to receive essential service-related and administrative communications necessary for your use of the Service.

Cookie Preferences: You will be able to manage your preferences for non-essential cookies (Analytics, Marketing) through a consent management tool on our website/Service. You can also typically control cookies through your browser settings.

Benchmarking (Future Feature): Benchmarking is a future feature that has not yet launched. When it launches, participation in contributing aggregated and irreversibly de-identified data to the benchmarking program will be required in order to access the benchmarking insights. Customers who do not wish to contribute data will not receive access to benchmarks.

Basis for Processing (EEA/UK Users): If you are located in the European Economic Area (EEA) or the United Kingdom (UK), our legal basis for collecting and using the personal information described above will depend on the information concerned and the specific context. We normally collect personal information from you only where we need it to perform a contract with you (or your organization), where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms (e.g., providing, securing, and improving the Service), or where we have your consent (e.g., for marketing communications or non-essential cookies).

Exercising Your Rights: To exercise any rights you may have under applicable privacy laws that are not manageable directly through the Service, please contact us at privacy@evident.security. We may need to verify your identity before processing your request. We will respond to your request within the timeframe required by applicable law. We will not discriminate against you for exercising your privacy rights.

Cookies and Tracking Technologies

As mentioned above, we use essential cookies (for functionality and security) and analytics cookies (e.g., PostHog, to understand usage) and we plan to implement marketing cookies in the future. You will be able to manage your consent and preferences for non-essential cookies via a consent management tool when available. Most web browsers allow you to control cookies through their settings preferences.

MCP Server (Model Context Protocol Connector)

Evident operates a Model Context Protocol ("MCP") server at mcp.trustmind.com that allows MCP-compatible AI clients (for example, Claude.ai, Claude Desktop, ChatGPT, and Cursor) to interact with your Evident workspace on your behalf. This section describes how the MCP surface handles your information; the rest of this Privacy Policy continues to apply.

How the MCP Server Works

When you (or your organization's administrator) connect an MCP-compatible client to Evident, you authorize that client via OAuth 2.1 with Dynamic Client Registration. The MCP server issues short-lived access tokens and longer-lived refresh tokens that the client uses to call MCP capabilities. Requests flow directly between the AI client and Evident; no additional third-party service is interposed in the MCP request path.

Information the MCP Server Processes

Identity: The MCP server resolves your Evident user identity, organization membership, role, and permissions on each request. This information is not stored separately for MCP purposes; it is read from your existing Evident account.

OAuth tokens: Access tokens (valid for one hour) and refresh tokens (valid for thirty days) are stored as SHA-256 hashes; the plaintext token value is only returned to the client at issuance and is not retrievable thereafter. Tokens can be revoked from your Evident account at any time; revocation invalidates the refresh token immediately and rejects subsequent refresh attempts.

Audit log: Each MCP capability invocation is recorded server-side with the calling user, organization, capability name, timestamp, outcome (success, permission denied, identity error, or handler error), duration, and error type if applicable. Tool arguments and tool responses are not stored in the audit log.

Information Returned to Your AI Client

When you (or an AI client acting on your authority) invoke an MCP capability that returns workspace content — for example, a questionnaire summary, a question detail, an assignment list, or supporting evidence — that content is returned to the AI client you connected. From there, the AI client's handling of your data is governed by the privacy policy and terms of the AI provider you chose (such as Anthropic for Claude.ai and Claude Desktop, OpenAI for ChatGPT, Cursor, or the vendor of any other client you install). Evident does not control and is not responsible for how a connected AI client subsequently stores, transmits, or uses returned content.

Connected AI clients are not Evident subprocessors. They act on the authority you grant them through the OAuth flow. Your relationship with the AI provider — including their own data-handling and AI-training terms — governs their use of any data returned by the MCP server. Evident's no-model-training commitment applies to Evident's own systems and our AI subprocessors; it does not bind third-party AI hosts you connect via MCP, whose policies you accepted when installing the connector.

Your Choices

You can list and revoke connected MCP clients at any time from your Evident MCP settings. Revoking a client invalidates its refresh token immediately; any access token already issued to that client will continue to function until it expires (within one hour). To request review of MCP audit-log entries for your organization, contact privacy@evident.security.

International Data Transfers

Evident is based in the United States (incorporated in Delaware, operating from California), and the Service is primarily hosted and operated in the United States using service providers like AWS and Cloudflare. If you are accessing the Service from other regions (like the EEA or UK), your information will be transferred to, stored, and processed in the United States.

We take appropriate safeguards to protect your information in accordance with this Privacy Policy when it is transferred. For transfers of personal information from the EEA, UK, or Switzerland, we rely on mechanisms such as Standard Contractual Clauses or adequacy decisions, where applicable, as provided by our third-party service providers.

Children's Privacy

The Service is not directed to individuals under the age of 13 (or 16 in certain jurisdictions like the EEA/UK). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child without verification of parental consent, we will take steps to delete that information. If you believe we might have any information from or about a child, please contact us at privacy@evident.security.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make changes, we will notify you by revising the "Last Updated" date at the top of this policy. If we make material changes that significantly alter your privacy rights, we will provide additional notice, such as sending an email notification or displaying a prominent notice within the Service prior to the change becoming effective. We encourage you to review this Privacy Policy periodically to stay informed about our information practices.

Subprocessors

We use the following subprocessors to provide and support the Service:

Contact Information

If you have any questions, comments, or concerns about this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please contact us at: privacy@evident.security