TypingMind

US CLOUD Act exposureproprietary

Homepage ↗

USAGE ON STAV · LAST 12 WEEKS

Where TypingMind shows up on Stav.

Live usage rolls up every five minutes. We surface the 12-week trend once enough requests have flowed through this app.

STAV REVIEW · LAST REVIEWED 06/21/2026

“Clean BYOK architecture in consumer mode, but Teams/cloud tier stores prompts on CLOUD Act–exposed infrastructure with no published retention terms or confirmed DPA.”

Good for

Teams wanting a model-agnostic chat UI where each user brings their own API key and Inference stays entirely off vendor infrastructure
Organisations that need SSO, audit logging, and an admin API without building a chat frontend from scratch
Self-hosted deployments where the team can run the application on their own infrastructure and route Inference through Stav
Individuals or small teams on a one-time lifetime licence who want a capable web-based interface without a recurring subscription

Watch out for

Teams/cloud tier at custom.typingmind.com routes prompts and completions through vendor-controlled servers under CLOUD Act jurisdiction — no data retention period is published and no DPA has been publicly confirmed, blocking GDPR-compliant use in regulated EU environments
SOC 2 Type II is claimed but unverifiable: the Sprinto Trust Center subdomain returned a DNS failure in the most recent research cycle and the full audit report has not been publicly surfaced
Telemetry is broad and on by default — over 25 third-party endpoints including PostHog, Intercom, Twitter Ads pixels, Zendesk, and a Windfall tracker load on page render with no confirmed opt-out mechanism and no accessible consent gate
Closed-source, compiled-only distribution means no independent code audit is possible even on the self-hosted plan; single-founder bus factor adds operational continuity risk

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

MODEL REQUIREMENTS

What TypingMind needs from a model.

Required

Streaming

Recommended

Long context (≥128k)
Tool calling
Vision input

Data flow & telemetry

How TypingMind moves data between the client, the inference endpoint and any vendor-owned services.

Data flow

Direction: direct_to_vendor
Stores prompts: Yes

Telemetry

Collects telemetry: true
Privacy policy: https://docs.typingmind.com/security-and-compliance/privacy-policy

Vendor & licensing

Developer: Devuap LLC (TypingMind)
Vendor country: US
Vendor type: startup
Funding status: bootstrapped
Runtime type: web_app
Open source: No
Licence: proprietary
Licence risk: commercial
CLOUD Act exposure: Yes

Security & maintenance health

Security profile

Bug Bounty: false
Cve Count 90d: 0
Sbom Published: false
Cve Count Total: 0
Signed Binaries: false
Has Security Txt: false

Maintenance health

Archived: false
Bus Factor: 1
Commits 90d: 2
Last Commit: 2026-06-18
Open Issues: 0
Contributors 90d: 1
Last Commit Date: 2026-06-18