Security pack. Facts, not claims.

1. Purpose and nature of the pack

The pack brings together in one place the answers to the questions a company or its adviser asks before choosing an application: where the data is, who has access to it, how it is protected and what happens in the event of a failure. The service is provided by MIVARE GROUP PROSTA SPÓŁKA AKCYJNA, with its registered office in Krasnobród, KRS 0001268091, NIP 9223092251, REGON 545767254, operating under the Mivare Space brand, hereinafter “Mivare”.

The pack is for information only and creates no obligations beyond the contract documents. The binding documents are: the Mivare Space Terms of Service (MSP-LEG-001), the Data Processing Agreement (MSP-LEG-003, hereinafter the “DPA”) and the Service Level Agreement (MSP-LEG-005, hereinafter the “SLA”). In the event of any discrepancy, those documents prevail. The pack describes only safeguards that are actually in place; where something is not implemented, it says so plainly.

2. Where the data is

• The Application and its database run on a Contabo GmbH server in a data centre in the European Union.
• Files (photos, attachments) are stored in a private file store (Object Storage) in the European Union, separately for each company account.
• Backups are stored in the European Union, in a separate store, kept apart from the Application server and from the file store.
• Entrusted data is not transferred outside the European Economic Area.

The full list of subprocessors (Contabo, OVH, Mistral AI), with the scope of their access to data, is in section 8 of the DPA. We notify the account administrator by e-mail in advance of any planned addition or replacement of a subprocessor, and the company may object within 14 days.

3. Separation of company data

The data of each company account is logically separated from the data of other companies at application and database level. Files are stored separately for each account and made available only through the Application, after permissions are checked. We do not combine the data of different companies, do not sell it and do not use it for profiling or for training artificial intelligence models.

4. Sign-in and user access

• Passwords are stored solely in hashed form using the Argon2id algorithm; the Application checks password strength and rejects commonly known passwords.
• Two-factor authentication (TOTP) is available to every user, and the account administrator may require it for everyone.
• Sign-in attempts are limited, and the account is locked after failed attempts.
• Inactive sessions expire automatically.
• The account administrator grants and withdraws access and sets the permissions of each user.
• Actions in the Application are recorded in an event log, which the administrator keeps for a chosen period of 30 to 180 days.

5. Data protection in the Application

Status of safeguards on the effective date of the pack:

• encryption of connections using TLS: implemented;
• encryption of files by the Application before they are written to the file store, with decryption only when an authorised user downloads them: implemented;
• antivirus scanning of every uploaded file before it is stored: implemented;
• public functions of the Application accessible only through links with a random key and an expiry date, the key being stored in the database solely in hashed form, with additional verification using data known to the authorised person, a limit on attempts and logging of each opening: implemented;
• removal of metadata, including location, from uploaded photographs: implemented;
• a separate permission for costs and margins: implemented;
• encryption of backups before they are written, with the key kept off the server and away from the backup store: implemented;
• security updates and patches: implemented;
• security incident handling procedure: implemented;
• encryption of the database on the server disk: not implemented, planned. Until it is implemented, data in the database is protected by access control, the principle of least privilege and event logging.

We hold no ISO or SOC certification and do not claim compliance with such standards.

6. Access by Mivare staff

Only authorised persons bound by confidentiality are given access to data. Access to the data of a specific company account takes place only to the extent necessary to handle a request from the account administrator, to fix a failure or to ensure security. Mivare administrative accounts are protected by two-factor authentication and operate on the principle of least privilege.

7. Backups and continuity

• A database backup every hour, kept for 7 days.
• A full database backup once a day, kept for 3 days.
• A continuous file backup, in which a deleted file remains for no more than 30 days.
• Periodic data restore tests.

The service is provided on a best-effort basis: we do not declare a percentage availability level or a maximum restore time and data loss window (RTO and RPO). Planned interruptions longer than 15 minutes are announced at least 48 hours in advance. Details, including request priorities and handling targets, are in the SLA.

8. The Mivi assistant

The Mivi assistant is switched off by default. The account administrator switches it on for the whole company, and each user then decides whether to use it. Requests are handled by Mistral AI in the European Union, without the data being used to train models; the provider keeps requests and responses for no more than 30 days solely to detect abuse.

Only the data needed for the answer, to which the user in question has access, is sent to the assistant. Passwords, authentication data, payment card data, PESEL numbers and identity document numbers are not sent. Switching the assistant off immediately stops the transfer of data. The full scope of data is described in section 8 of the DPA.

9. Incidents and breaches

We notify the account administrator of a personal data breach without undue delay, no later than 48 hours after becoming aware of it, and provide the information needed to report the breach to the supervisory authority. We inform account administrators of a failure affecting many customers and, once it is resolved, give its cause and the action taken.

10. Data after the end of the contract

The company can download a copy of its data at any time using the export function in the Application (a ZIP archive containing CSV files and attached files). After the end of the contract we keep the data for 30 days to allow export or resumption of the service, and then delete it, no later than 60 days after the end of the contract. Data in backups disappears in the rotation cycle, no later than 30 days after deletion from the Application. On request, we confirm the deletion.

11. Questions and audit

We answer questions about the Application, safeguards and subprocessors within 14 days; please send them to hello@mivaregroup.com. If the answers are not sufficient, the company or an independent auditor bound by confidentiality may carry out an audit under section 13 of the DPA, no more than once every 12 months, except for an audit following a personal data breach.

Technical requests and failures: support@mivarespace.com. Do not include passwords or authentication codes in a request.

The pack is available in seven language versions; in the event of any discrepancy, the Polish version prevails. The current version is available at https://mivaregroup.com/en/legal/space/security/

This pack is effective from 30 October 2026.