Security

Livestock records, treatment logs and load histories are business-critical data. This page describes how Mule protects the systems it builds and runs. Clients receive the full measures in their DPA and can ask security questions at any time.

1. Principles

• Your data, under your rules. Each client's data sits in its own database or schema, in the EU or the US, by the client's choice.
• Least privilege. Staff and users get only the access their role needs. Permissions are enforced in the database, not only in the interface.
• Records you can prove. Important records such as loads, treatments and signatures are append-only, with device time and server time, so changes leave a trail.

2. Access

• Multi-factor authentication for every Mule staff account and for client owners and billing roles in the Portal.
• Production access is logged and removed within 1 business day of a role change.
• No shared accounts.

3. Data protection

• TLS 1.2 or higher for all traffic; encryption at rest by our hosting and database providers.
• Secrets in a managed store, never in code or chat.
• Daily encrypted backups, with a restore tested at least every 6 months.
• Field apps that work offline keep a local encrypted queue and sync when back in range.

4. Building software

• Code review on every change, dependency and secret scanning, separate staging and production.
• No unmasked production personal data in development.
• Security updates for frameworks and dependencies applied monthly, and critical patches as soon as practical, under every retainer.

5. Website

• Strict security headers, including a Content Security Policy, HSTS and frame protection.
• No optional third-party script loads before consent.

6. Incidents

Mule keeps a written incident response plan. Clients are told of a personal data breach affecting their data without undue delay and within 48 hours of Mule becoming aware of it.

7. Certifications

Mule does not hold ISO 27001 or SOC 2 certification today. We will publish any certification here only once it is granted.

8. Report a vulnerability

See Responsible disclosure and our security.txt.