1. Restricted access
MineCart has no public account registration. An administrator must approve each account. Depending on the deployment, approved users authenticate with verified Google identity or an administrator-issued username and password. Repeated password failures are rate-limited and locked out.
2. Transport and browser controls
Production traffic is encrypted with HTTPS. Secure session settings, strict transport policy, cross-site request protection, clickjacking protection, and a restrictive content security policy reduce common browser risks. Application scripts, styles, images, and fonts are served from the MineCart origin.
3. Authorization and audit
Operational pages require authentication. Administrative and data-exploration tools require staff access. MineCart records important events such as authentication activity, uploads, downloads, run triggers, and manual data pulls so operators can review what happened.
4. Data protection and recovery
Operational state is stored in a transactional database with continuous backup in production. Data files use atomic writes and versioned object storage. Raw external data is archived before transformation so interrupted processing can be recovered without repeating a limited external request.
5. Model integrity
MineCart loads versioned model artifacts from restricted storage, validates expected contents, and records the artifact version used by a run. Regression tests pin critical scoring behavior so code or artifact changes cannot silently alter recommendations without review.
6. Operational safeguards
The pipeline uses readiness checks and a single-flight lock to prevent overlapping runs. Production startup refuses known unsafe configurations. Health checks cover both the web process and the scheduler used for daily work.
7. Compliance status
MineCart does not claim a public certification or compliance authorization on this page. Security requirements for a customer deployment are handled through the applicable agreement and review process.
8. Report a concern
Send suspected vulnerabilities or security incidents to [email protected]. Please include enough detail to reproduce the issue and avoid accessing data that is not yours.