Security pack. Facts, not claims.

1. Purpose and nature of the pack

The pack brings together in one place the answers to the questions a law firm asks before entrusting data covered by professional secrecy: where the data is, who can see it and when, how it is protected and what happens in the event of an incident. The service is provided by MIVARE GROUP PROSTA SPÓŁKA AKCYJNA, with its registered office in Krasnobród, KRS 0001268091, NIP 9223092251, REGON 545767254, operating under the Consilaris brand, hereinafter “Mivare”.

The pack is for information only and creates no obligations beyond the contract documents. The binding documents are: the Consilaris Terms of Service (CNS-LEG-001), the Data Processing Agreement (CNS-LEG-003, hereinafter the “DPA”) and the Service Level Agreement (CNS-LEG-005, hereinafter the “SLA”). In the event of any discrepancy, those documents prevail. The pack describes only safeguards that are actually in place; where something is not implemented, it says so plainly.

2. Professional secrecy

• We treat all of the law firm's data as covered by advocates' or attorneys-at-law's professional secrecy or other legally protected secrecy, regardless of how it is marked.
• Every person given access to the law firm's data, at Mivare and at a sub-processor, has undertaken in writing, for an unlimited period, to keep it secret.
• If a court, prosecutor or other authority demands the data, we promptly notify the law firm unless the law prohibits it, inform the authority that the data may be covered by professional secrecy, and hand it over only to the extent required by a provision of law or a final decision. We do not disclose data voluntarily or on the basis of a mere request.
• We do not contact the law firm's clients and do not confirm to third parties whether the law firm processes the data of a particular person.

3. Where the data is

• The Application and its database run on a Contabo GmbH server in a data centre in the European Union.
• Files are stored in a private file store (Object Storage) in the European Union, separately for each law firm account.
• Backups are stored in the European Union, in a separate store, kept apart from the Application server and from the file store.
• Entrusted data, including backups, is not stored or processed outside the European Union.

The full list of sub-processors (Contabo, OVH, Mistral AI), with the scope of their access to data, is in section 9 of the DPA. We notify the account administrator by e-mail at least 30 days before any planned addition or replacement of a sub-processor, and the law firm may object within 14 days.

4. Who can see the data and when

Mivare staff become acquainted with the content of the law firm's data only:

• at the request of the account administrator or an authorised user, to the extent and for the time needed to handle it;
• where necessary to remedy a failure, restore data or avert a security threat; we notify the law firm of such access, its reason and scope no later than within 3 working days.

We document every access to the content of the data (person, date, reason, scope) and, at the law firm's request, provide it with a list of accesses. Server maintenance, updates and backups do not require becoming acquainted with the content of the data.

5. Sign-in and permissions within the law firm

• Passwords are stored solely in hashed form using the Argon2id algorithm; the Application checks password strength and rejects commonly known passwords.
• Two-factor authentication (TOTP) is available to every user, and the account administrator may require it for everyone.
• Sign-in attempts are limited, and the account is locked after failed attempts; inactive sessions expire automatically.
• The law firm grants permissions to users, and each user sees only the matters, their files and documents to which the law firm has given them access (view or edit).
• Actions in the Application are recorded in an event log, which the law firm keeps for a chosen period of 30 to 180 days.

6. Data protection in the Application

Status of safeguards on the effective date of the pack:

• encryption of connections using TLS: implemented;
• logical separation of the data of each law firm account at application and database level: implemented;
• encryption of files by the Application before they are written to the file store, with decryption only when an authorised user downloads them: implemented;
• antivirus scanning of every uploaded file before it is stored: implemented;
• the law firm's KSeF token and certificate stored solely in encrypted form (AES-256-GCM, key kept outside the database), with the certificate's private key never displayed, never downloadable and excluded from the data export: implemented;
• encryption of backups before they are written, with the key kept off the server and away from the backup store: implemented;
• security updates and patches: implemented;
• security incident handling procedure: implemented;
• encryption of the database on the server disk: not implemented, planned. Until it is implemented, data in the database is protected by access control, the principle of least privilege, written secrecy undertakings and event logging.

We hold no ISO or SOC certification and do not claim compliance with such standards.

7. Backups and continuity

• A database backup every hour, kept for 7 days.
• A full database backup once a day, kept for 3 days.
• A continuous file backup, in which a deleted file remains for no more than 30 days.
• Periodic data restore tests.

The service is provided on a best-effort basis: we do not declare a percentage availability level or a maximum restore time and data loss window (RTO and RPO). Planned interruptions longer than 15 minutes are announced at least 72 hours in advance. Details, including request priorities and handling targets, are in the SLA.

8. The Mivi assistant

The Mivi assistant is switched off by default. The account administrator switches it on for the whole law firm, and each user then decides whether to use it. Before switching it on, the law firm assesses whether such processing is consistent with its professional secrecy obligations and may decide which users use it.

Requests are handled by Mistral AI in the European Union, without the data being used to train models; the provider keeps requests and responses for no more than 30 days solely to detect abuse. Only the data needed for the answer, to which the user in question has access, is sent to the assistant; passwords, authentication data, payment card data, PESEL numbers and identity document numbers are not sent. Switching the assistant off immediately stops the transfer of data. The full scope of data is described in section 9 of the DPA.

9. Incidents and breaches

We notify the account administrator of a personal data breach, and of any event that may have resulted in the disclosure of information covered by professional secrecy, without undue delay, no later than within 24 hours of becoming aware of it. We assist the law firm in notifying the supervisory authority and in its obligations towards the professional self-governing body. We inform account administrators of a failure affecting many customers and, once it is resolved, give its cause and the action taken.

10. Data after the end of the contract

The law firm can download a copy of its data at any time using the export function in the Application (a ZIP archive containing CSV files and attached files). After the end of the contract we keep the data for 30 days to allow export or resumption of the service, and then delete it, no later than 60 days after the end of the contract. Data in backups disappears in the rotation cycle, no later than 30 days after deletion from the Application. On request, we confirm the deletion. The secrecy obligation continues for an unlimited period.

11. Questions and audit

We answer questions about the Application, safeguards, sub-processors and the list of accesses within 14 days; please send them to hello@mivaregroup.com. If the answers are not sufficient, the law firm or an independent auditor bound by confidentiality may carry out an audit under section 14 of the DPA, no more than once every 12 months, except for an audit following a personal data breach.

Technical requests and failures: biuro@consilaris.pl. Do not include passwords or authentication codes in a request.

The pack is available in Polish and English; in the event of any discrepancy, the Polish version prevails. The current version is available at https://mivaregroup.com/en/legal/consilaris/security/

This pack is effective from 29 October 2026.