Your data is secured with industry-standard encryption
As a platform for Danish kindergartens, we handle sensitive information about children and families. That's why we built Minly with security as a top priority from day one.
AES-256 encryption of sensitive data
All sensitive information about children - allergies, illnesses, medication, and other health data - is encrypted with AES-256-CBC. This is the same encryption standard used by banks, healthcare, and military worldwide.
# Children's health data is encrypted automatically
encrypt("allergi: jordnødder")
→ aGVqIHNpZGRlciBkZXIgb2cgbMOmc2VyIGRldHRl...
# Only authorized users can decrypt
decrypt(data, auth_key)
→ "allergi: jordnødder"
# Unauthorized access = unreadable data
unauthorized_access(data)
→ ⛔ aGVqIHNpZGRlciBkZXIgb2cgbMOmc2VyIGRldHRl...
World-class secure infrastructure
Minly runs on professional infrastructure with redundancy, automatic failover, and continuous monitoring.
EU datacenter
All data is hosted in Germany at Hetzner, one of Europe's most secure and reliable data centers. Hetzner is ISO 27001 certified with world-class physical security.
- ISO 27001 certified datacenter
- 24/7 physical security
- 100% green energy
Redundancy and backup
Your data is never at risk. We take automatic backups multiple times daily, and all systems have redundancy to ensure continuity.
- Daily automatic backups
- 30 days backup history
- Automatic failover
High uptime
Minly is available when you need it. Our infrastructure is designed for high availability with continuous monitoring.
- 24/7 system monitoring
- Automatic alerts
- Planned maintenance outside business hours
Institution isolation: Data from each institution is completely separated
Role-based access control
Not everyone needs access to everything. Minly uses role-based access control (RBAC) to ensure users can only see and do what they need.
Built with security from day one
Minly is developed with modern security practices and follows industry best standards to protect against known vulnerabilities.
OWASP Top 10
Protected against the 10 most critical security risks incl. SQL injection and XSS
CSRF protection
All forms are protected against cross-site request forgery attacks
Rate limiting
Protection against brute-force attacks and automated threats
Security headers
CSP, HSTS, X-Frame-Options and other security headers enabled
Password security
- Bcrypt hashing with salt (passwords are never stored in plain text)
- Strong password requirements
- Secure password reset via email
Session security
- Secure session cookies (HttpOnly, Secure, SameSite)
- Automatic session timeout on inactivity
- Session renewal on login
GDPR and data protection
As a data processor for Danish childcare institutions, we fully comply with the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act. Health information about children is treated as special categories of personal data (GDPR Article 9) with enhanced security measures.
Includes:
- Purpose and nature of processing
- Categories of personal data
- Technical security measures
- Sub-processors
- Terms upon termination
Frequently asked questions about security
Here you'll find answers to the most common security questions
Where is our data stored?
How is children's health data protected?
Can parents see other children's information?
What happens in case of a security breach?
Do you backup our data?
Does Minly comply with GDPR?
This page provides an overview of our security measures. Detailed security specifications and obligations are set out in the data processing agreement and our terms of service. Minly uses sub-processors including Hetzner (hosting) and Postmark (email), all with EU-based data processing.
Do you have questions about our security?
We are always ready to answer questions about security, data protection, and compliance. Contact us for a non-binding conversation.