Trust & Security

Security at Mizan

Your organizational data is highly sensitive. We take security seriously with enterprise-grade protection, compliance certifications, and transparent practices.

Encryption Everywhere

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Your information is protected at every layer.

SOC 2 Type II Certified

Our infrastructure is audited annually against rigorous security, availability, and confidentiality standards.

24/7 Monitoring

Continuous security monitoring, threat detection, and incident response to protect your data around the clock.

Infrastructure Security

Mizan is hosted on enterprise-grade cloud infrastructure with multiple layers of protection:

  • Railway & Vercel: SOC 2 certified platforms with 99.99% uptime SLA
  • AWS-backed database: PostgreSQL with automated backups and point-in-time recovery
  • DDoS protection: Cloudflare enterprise protection against attacks
  • Network isolation: Segmented networks with strict firewall rules
  • Redundancy: Multi-region failover and automated disaster recovery

Data Protection

Encryption

  • In transit: TLS 1.3 with perfect forward secrecy
  • At rest: AES-256 encryption for all database records and file storage
  • Key management: Hardware security modules (HSM) for encryption keys

Data Isolation

  • Tenant separation: Logical data isolation per organization
  • No cross-contamination: Your data is never mixed with other customers
  • Secure deletion: Cryptographic erasure when you delete data

Access Controls

  • Role-based access control (RBAC): Granular permissions by user role
  • Multi-factor authentication (MFA): Available for all accounts
  • SSO integration: SAML 2.0 support for enterprise customers
  • Session management: Automatic timeout and secure token handling
  • Audit logs: Complete trail of all data access and modifications
  • Employee access: Zero standing access - all access is logged and time-limited

Compliance & Certifications

We maintain compliance with major security and privacy regulations:

SOC 2 Type II

Independently audited security controls

GDPR

EU data protection compliance

CCPA

California privacy law compliance

ISO 27001

Information security management (in progress)

AI & Data Privacy

Mizan uses AI to analyze organizational data. Here's how we protect your privacy:

  • No AI training on your data: Your organizational data is never used to train AI models
  • Ephemeral processing: AI analysis happens in real-time and is not retained by providers
  • Enterprise AI agreements: Data processing addendums with OpenAI, Anthropic, Google, Mistral
  • Data minimization: Only necessary data is sent to AI providers
  • Anonymization: Personal identifiers are stripped where possible

Incident Response

We have a formal incident response plan to handle security events:

  • Detection: 24/7 automated monitoring and alerting
  • Containment: Immediate isolation of affected systems
  • Investigation: Root cause analysis and impact assessment
  • Notification: Timely communication to affected customers
  • Remediation: Fix vulnerabilities and restore normal operations
  • Post-mortem: Document lessons learned and improve processes

Vulnerability Management

  • Regular penetration testing: Annual third-party security assessments
  • Bug bounty program: Responsible disclosure program (coming soon)
  • Dependency scanning: Automated checks for vulnerable libraries
  • Patch management: Critical patches applied within 24 hours
  • Code review: Security-focused peer review for all changes

Transparency

We believe in being open about our security practices:

  • Security page: This page is regularly updated with our latest practices
  • Status page: Real-time platform status and incident history
  • Security questionnaires: We respond promptly to customer security inquiries
  • Documentation: Detailed security documentation available to enterprise customers

Report a Security Issue

If you discover a security vulnerability, please report it responsibly:

Email: security@mizan.ai

We commit to acknowledging your report within 24 hours and providing regular updates on our investigation.