Security
How Miross handles your data.
The short version. The long version is the SECURITY.md we keep with the code.
Tenancy
- Every record carries its workspace; nothing is readable across workspaces.
- Roles: admin, agent, viewer. Non-members get “not found”, not “forbidden”.
Credentials and keys
- Passwords are hashed with Argon2id; sessions are opaque tokens stored hashed.
- Two-step verification with an authenticator app (TOTP) and recovery codes, for every account; Scale workspaces can require it for all members.
- Marketplace API keys are encrypted with AES-256-GCM under rotating keys and never returned.
- Mailboxes and chats connect through a hosted sign-in wizard: credentials never reach Miross.
AI
- On by default, with one switch per workspace to turn it off. Requests from Miross are decrypted and processed only inside the EU (eu.openrouter.ai) and go only to model providers operating in the EU: Mistral AI (France), Amazon Web Services (Ireland), Google Cloud (EU) and Microsoft Azure (EU, for case summaries).
- Zero data retention: those providers must keep nothing (in-memory caching aside), and prompts are never used for training. Only the stripped text of the messages involved is sent (for voice notes and images the file itself, for a PDF or Word document only the text we extract on our own server) and every call is metered.
- AI never replies on its own. Model output is checked before it can reach a customer; suggested actions are re-verified server-side and confirmed by a person.
Where data goes
- Database, attachments and backups: Hetzner, in Nuremberg, Germany.
- Mailboxes and chats connect through Unipile (France, hosted on Scaleway). WhatsApp and LinkedIn messages and media, voice notes included, are stored there until the connected account is deleted; for IMAP and Microsoft mailboxes only metadata, for Gmail nothing. Deleting a connection or the workspace deletes the account at Unipile too; its optional proxy providers are in the USA and Singapore.
- Email for the relay channels (Amazon, bol.com and TikTok Shop), emails to live chat visitors (answers they missed, transcripts) and account email (invitations, password resets, alerts) go through Resend in the USA, under the Standard Contractual Clauses and the Data Privacy Framework. Resend keeps message content, logs and webhook payloads for up to 30 days.
- OpenRouter’s records of Miross’s own account (billing, authentication, security and abuse-monitoring logs) may be kept outside the EU; message content is not among them.
Webhooks and email
- Inbound webhooks (Stripe, Resend, Unipile) are verified by signature or shared secret before parsing.
- Relay addresses (Amazon, bol.com, TikTok Shop) carry a random suffix. On Amazon, only mail from buyer aliases becomes a case; the marketplace’s own setup mail (an address confirmation, an activation link) never becomes a case.
Auditing and data rights
- Append-only audit log of sign-ins, sends, actions and rule runs.
- Workspace export and deletion are first-class; deletion purges.
Security reports: security@miross.io