Trust

Trust center

Version 1.0 · 22 October 2026 · Draft for formal adoption. Scope: MENSCH and relevant related legal entities, in accordance with contracts and applicable law.

1. Purpose and scope

The trust centre is the central place where MENSCH explains how it approaches responsible development, information protection, privacy, business ethics, and supplier relationship management. The information applies to MENSCH services to the extent set out in the specific contract. This document is not a certificate, an independent audit report, or a promise of identical controls for every project.

2. Our responsibility

MENSCH develops websites, applications, integrations, and MenschOS solutions. For each project, scope, responsibilities, access, delivery method, and appropriate protection measures are defined. MENSCH and client responsibilities differ depending on the hosting and maintenance model.

3. Risk management

Risks are assessed according to data sensitivity, system exposure, number of users, third-party dependencies, and incident consequences. Priorities, risk owners, and measures to reduce them are established. The assessment is reviewed when significant changes occur.

4. Secure development

Access is granted as needed, confidential values are not embedded in public code, and changes are checked before production to an extent appropriate to the project. Security gaps are recorded and handled according to risk.

5. Privacy

Personal data are processed only with an appropriate legal basis and for defined purposes. When MENSCH processes data on client instructions, roles and obligations are governed by a data processing agreement where required.

6. MenschOS and shared responsibility

On a multi-tenant platform, separation of data and authorisations is a key requirement. The client is responsible for the lawfulness of entered data, management of its users, and use of features; MENSCH is responsible for the contracted part of the platform and its management.

7. Third parties

Hosting, payments, email, analytics, and AI services may involve external providers. Their engagement, processing locations, and responsibilities are assessed for the specific solution. Not all providers are sub-processors for personal data.

8. Business continuity

Backups, recovery, monitoring, and availability targets exist only to the extent of the contracted service. A recovery plan should define responsible persons, communication, and priority for restoring key functions.

9. Transparency and evidence

On a reasonable client request, MENSCH may provide applicable policies, a description of relevant controls, and answers to a security questionnaire, while protecting trade secrets and security-sensitive details. Passwords, configurations that enable attack, or other clients' data are not published.

10. Incidents and reports

Suspected incidents or vulnerabilities are reported to hi@mensch.rs, with the subject line "Security report". A report should include a description, affected system, and steps to reproduce without sending unnecessary personal data. Acknowledgement of a report does not mean automatic acceptance of liability.

11. Related documents

12. Status and updates

This document is a draft for formal adoption. Claims about certification, independent audits, and specific technical controls are published only with verifiable evidence.

Document management

Responsible party: management of the relevant legal entity. Review: at least once a year. Effective date: date of formal adoption. Contact: hi@mensch.rs.