Skip to main content
MIDDLEMEN™

Trust and safety

Security built into every session

Account owners trust us with access. Taskers trust us with their identity and pay. Here is exactly how we protect both.

Read our security policy

How a work session is protected

Your login is coordinated via Telegram's end-to-end encrypted chat with verified admins. From then on, taskers only ever see the screen of a locked-down, recorded machine.
Account ownerCoordinates loginTelegram Encrypted ChatEnd-to-end secret chatIsolated virtual machineRECNo clipboardNo USBNo file transferNo printingRecorded for QA and disputesTaskerSees the screen, never the passwordEvery step is written to atamper-evident audit log

Our controls

  • Telegram encrypted chat

    Logins are shared directly via Telegram's end-to-end encrypted secret chat with verified administrators. Credentials are never exposed to taskers and are injected directly into secure isolated sessions.

  • 2FA enforcement

    Two-factor sign-in must be on for every account we work on, and for every staff and tasker login to our systems. We use app-based codes or security keys, not SMS, where the platform allows.

  • Session recording

    Every work session is recorded for quality checks, security and disputes. Recordings are encrypted and deleted after 90 days unless a dispute is open.

  • No clipboard or USB

    Copy-paste out of the session, file transfer, printing, screen sharing and USB devices are all blocked.

  • Isolated virtual machines

    Each account runs in its own locked-down virtual machine with a fixed network location. Nothing from one account can reach another.

  • NDAs

    Every tasker and staff member signs a plain-language confidentiality agreement before any access.

  • Data-processing agreements

    We sign data-processing agreements with account owners and platforms on request, and follow GDPR and NDPR principles.

  • Audit logs

    Every session start and stop, admin login, and permission change is logged, tamper-evident and kept for 2 years. Owners can export their account's log.

  • Anti-fraud checks

    Identity verification, device checks, duplicate-identity detection and location checks against the platform's allowed countries.

Who can see what

Access by role
DataTaskerQA staffAccount owner
Account passwordNeverNeverYes (it's theirs)
Work session (live)Own sessionsSamplesOn request
Session recordingsOwn sessionsYesTheir account only
Tasker ID documentsOwn onlyNeverNever
Accommodation detailsOwn onlyNeverNever
Audit logNoYesTheir account only

Platform compliance comes first

We re-check every platform's terms at least every quarter and whenever a platform announces changes. If a platform stops allowing managed work, we pause all work on that platform within one business day, tell owners and taskers, and help taskers move to other assignments.

Things we will never do

Share one tasker's identity as another's, use tools to hide a tasker's location, get around platform identity checks, or work on accounts that weren't submitted by their owner.

Security policy summary

Least-privilege access, reviewed monthly.

Encryption at rest and in transit for all personal data and credentials.

Incident response within 24 hours; affected owners and taskers notified within 72 hours.

Annual third-party penetration test. Summary available under NDA.

Identity data kept only as long as the law requires.

Report a vulnerability: security@middlemen.ai. We respond within 2 business days.

Read the Data Processing Agreement · Read the Privacy Policy

Want the full security policy?

We share our complete policy, controls list and latest penetration-test summary with owners and platforms under NDA.

Read our security policySubmit your account

Only for platforms that explicitly allow subcontracting and remote access.