Security
Customer email is the most sensitive thing a company can hand to software. This page states what MimiDesk does to protect it, and only what it actually does.
At a glance
01 · Where data lives
Each workspace is hosted in one region, the European Union, the United States or the United Arab Emirates, and the application, the database and the file storage run there together.
02 · Workspace isolation
Every conversation, contact and file belongs to exactly one workspace, and the server checks that on every request. A screen never grants access the server would refuse, so a bug in the interface cannot show one company's data to another.
03 · Network and encryption
Databases and file storage accept no public connections. They are reachable only over private endpoints inside our network, and everything in transit uses TLS 1.2 or newer.
The credentials that connect your mailboxes are encrypted with AES-256-GCM using keys specific to each workspace, and application secrets are held in a managed key vault rather than in code.
04 · Access and identity
Five built-in roles, from viewer to owner, plus custom roles for anything in between. User accounts can be provisioned and removed automatically from your identity provider with SCIM, and single sign-on is available on request.
05 · Privacy by structure
Personal mailboxes are private to their owner by default. Reports that team leads see are computed from metadata such as volumes and response times, never from message bodies, and they honour each person's analytics consent.
Internal notes live where the outbound send path cannot reach, so a private remark about a customer cannot be emailed to that customer by accident. Where privacy matters, we rely on structure, not on policy.
06 · AI and your data
No conversation content reaches an AI model until a workspace admin turns Mimi on, and the switch lists exactly what is sent and where before anyone confirms. Mimi reads only what the person asking is allowed to open.
When someone asks for a summary or a draft, only that one conversation is sent. Attachments are never sent, and email addresses and card numbers are replaced first. Every request, and every request Mimi declines, is written to the audit log.
07 · Export and erasure
A workspace can export its data, and the build checks that every table belonging to a workspace is included, so nothing is quietly left out. Erasure on request runs as a recorded process that ends with a receipt.
We only write retention promises where the software keeps them, and our legal documents are checked against the product.
08 · Honesty and disclosure
MimiDesk does not hold a security certification yet, and you will not find a compliance logo here until it does. What you will find is a plain statement of what the product does, the documents behind it, and a person who answers.
Questions
In the region your workspace is hosted in: the European Union, the United States or the United Arab Emirates. The application, the database and file storage for a workspace all run in that one region.
Not yet. We do not display certifications we do not hold. This page describes the controls the product actually has, and the data processing agreement sets out our commitments.
Data travels over TLS 1.2 or newer. The credentials that connect your mailboxes are encrypted with AES-256-GCM using per-workspace keys, and databases and storage are reachable only over a private network.
No. Every record belongs to exactly one workspace, and the server checks the workspace on every request, so data from one company is never returned to another.
Nothing until an admin turns Mimi on. After that, only the conversation a person asks about is sent, without attachments and with email addresses and card numbers masked. The admin settings page shows the destination, and every request is recorded in the audit log.
Yes. A workspace can export all of its data, and erasure on request runs as a recorded process that ends with a receipt.
SCIM provisioning is built in, and single sign-on is available on request.
Join the waitlist. We'll write when it's your turn — nothing else.
Rather talk first? Contact us
