Security
Your research stays yours
How Mosaic protects your projects, your library and your account.
Data protection
Encrypted in transit and at rest
Every connection to Mosaic uses HTTPS, and browsers are told never to fall back to plain HTTP. Your data is encrypted at rest by our database and hosting providers.
Connected-account tokens are encrypted
When you connect Google, Microsoft or Mendeley, the tokens Mosaic keeps for that connection are encrypted with AES-256-GCM before they are stored.
Private file storage
PDFs you upload are kept in private storage, not at public links.
Protected against clickjacking
Other websites cannot embed the Mosaic app in a frame to trick you into clicking, and every page sends security headers that stop content-type sniffing.
Workspace isolation
Row-level security on every table
Workspace data is guarded in the database itself, which checks that you belong to the workspace and project a row comes from. Row-level security is on for every table, and a test fails our build if any table has it turned off.
Tested across workspaces
Automated tests try to read and change another workspace's data and confirm every attempt is refused.
AI and your research
Your research is not used for training
Mosaic does not use your research content to train AI models, and we choose AI providers on terms that do not let them train on what we send them.
Your account and your data
Export your data
Download a zip of your projects, papers, notes, highlights, tasks, goals and documents from Settings at any time.
Delete your account
Delete your account from Settings. Our Privacy Policy sets out what is kept afterwards, and for how long.
Sign out everywhere
End every other session from Settings, for example after losing a device.
Limits on repeated attempts
Sign-in, password resets and AI features are rate limited to slow down guessing and abuse.
Verification
Verified by Google
Google reviewed and verified Mosaic's Google sign-in and the access it asks for to your Google account.
Certified by Microsoft
Mosaic's Word add-in passed Microsoft's certification for Microsoft Marketplace.
Read how we collect, use and keep your data in our Privacy Policy. Questions about security, or something to report? Contact us.