How Mireto protects client data.

Scan data is stored in the jurisdiction of the organization being assessed: Australia (AWS Sydney, ap-southeast-2) for Australian organizations, or a dedicated United States region for US organizations. This is determined automatically from the organization's country, not a manual request.

Control-plane data that is not tied to a single scan (user accounts, partner firm records, entitlements, audit logs) is held in Sydney.

The Vercel edge network routes requests globally, but data at rest remains in the scan's home region. When customer data is sent to third-party APIs during a scan (Anthropic, Brave Search and Cloudflare), those services process the request and do not retain customer data for training or reuse. See Privacy Policy §5 for the full list.

• Row-level security (RLS) is enforced on every user-facing table. A user can only read or modify rows they own.
• Service-role-only tables are used for audit and operational data (email queue, organization facts, firm members, scan shares). These tables are not readable from the browser under any circumstances.
• API keys and service-role credentials are stored as environment variables and never exposed to client code.
• Supabase Auth backs all user sessions. We support email sign-in and Google OAuth. Passwords are hashed by Supabase using bcrypt; we never see them.

• TLS 1.2+ on every connection. Certificates are managed by Vercel.
• Strict Transport Security (HSTS) with a one-year max-age.
• Content Security Policy (CSP) restricts scripts, styles, connections and frames to an explicit allow-list. The policy is declared in the project configuration and applied to every response.
• Frame-Ancestors: none and X-Content-Type-Options: nosniff prevent clickjacking and MIME sniffing.
• Referrer-Policy: strict-origin-when-cross-origin limits what we and third parties can see about where users came from.

• CSRF protection on all mutating API requests. Cross-origin POST, PUT, PATCH and DELETE requests are rejected unless they carry a matching token. Enforced in middleware before the handler runs.
• Rate limiting on scan start, tool runs and AI conversation endpoints to prevent abuse. Limits are applied per IP address, and per scan on conversational endpoints.
• Document processing extracts structured insights from uploaded files. Raw document text is retained for 90 days, then automatically purged. Only structured insights extracted from the document are retained long-term.
• Input validation with Zod on new and recently touched API routes. Payloads that do not match the expected schema are rejected with a structured error, never executed.

• HMAC-signed unsubscribe tokens so every unsubscribe link is tamper-evident and tied to the recipient. Links cannot be guessed or reused across accounts.
• Spam Act 2003 compliance. Every marketing email includes a one-click unsubscribe. Unsubscribes are honored immediately via a suppression flag that prevents all future sequence emails.
• SPF, DKIM and DMARC are configured on highimpactgroup.com.au so our mail is authenticated at the receiver.

• Self-serve tiers (AI Disruption Snapshot, Fast Track AI Strategy, Signal Pro, Research Console and Partner Solo/Practice) are billed through Stripe. Card numbers, CVCs and bank details are entered directly on Stripe's hosted payment page, never on our platform or servers.
• Subscriptions (Signal Pro, Research Console seats and Partner Solo/Practice) renew automatically until canceled, at a monthly or annual interval depending on the tier.
• A dedicated payment webhookreceives payment events from Stripe for self-serve tiers. Every event's signature is verified against our webhook secret before it is processed; requests that fail verification are rejected.
• Partner-delivered engagements, including Complete AI Strategy, are invoiced directly to your organization or your partner firm. Access for these is granted by entitlement, not an automated payment event.

• Snapshot scan data is automatically deleted 90 days after creation by a scheduled retention job.
• Complete AI Strategy scan data is retained while the user has active access, plus 90 days thereafter.
• Raw uploaded document text is retained for 90 days, then deleted. Only structured insights extracted from the document remain long-term.
• User-initiated deletion is immediate and permanent. Every deletion event is recorded in a deletion audit table so we can demonstrate compliance on request.

• Claude models are pinned to specific version IDs in code, not a floating alias. A silent model change cannot affect output quality without a code deployment.
• Commercial API terms apply. Data sent to Anthropic via the Claude API is not used to train Anthropic's models, per their published commercial terms.
• Prompt injection defenses on user-supplied inputs routed into AI calls. We treat uploaded documents and chat messages as untrusted input.

• Hosting: Vercel (global edge network, data at rest in the scan's home region).
• Database and auth: Supabase. Scan data is stored in the jurisdiction of the organization (Australia or US). Encryption at rest is AES-256; backups are managed by Supabase.
• Email: Resend for transactional and sequence email, with SPF, DKIM and DMARC configured on the sending domain.
• Research and enrichment: Brave Search API and Cloudflare for website crawling. Queries are not linked to user identity.
• Payments: Stripe for self-serve payment processing and subscription billing. Card details are entered on Stripe's hosted payment page, not ours.

If you believe you have found a security issue in Mireto, please email support@highimpactgroup.com.au with a description of the issue and, where possible, steps to reproduce. We will acknowledge receipt within two business days and keep you informed through remediation. We ask that you do not publicly disclose the issue until we have had a reasonable opportunity to respond.

Mireto handles personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and the Spam Act 2003. We do not currently hold ISO 27001 or IRAP certification. If your procurement process requires either, contact us and we will respond directly on our plan and timeline.

General security enquiries and privacy matters: Contact us

High Impact Group Pty Ltd
ABN 40 682 923 128
Australia