Security · deployment · control
Mirmi SaaS and customer data are hosted in France by Scaleway. Isolation, encryption, access control, traceability and deployment options complete this foundation.
Architecture, data flows and responsibilities documented for the selected model.
Choose the scope of control
Deployment matrix
France SaaS
Environment operated by Mirmi
Dedicated VPC
Dedicated cloud environment
On-premise
Deployment in your infrastructure
Key controls
Choose the level of control that fits your requirements, integrations and responsibility model.
Deployment models
The application environment and customer data are hosted in France by Scaleway, in the fr-par region. Mirmi handles updates and operations, with an isolated client scope.
Documented configuration: integrations, inbound and outbound flows, retention, backups and administrative access.
When this architecture is selected, Mirmi components are deployed in a cloud environment dedicated to the client and integrated with agreed identity, network and monitoring standards.
Documented configuration: cloud account, operating responsibilities, connectivity, key management and observability.
Where the scope requires it, Mirmi can be installed in infrastructure controlled by the client, with required dependencies and data flows made explicit.
Documented configuration: technical prerequisites, maintenance, updates, capacity, backup and support.
The selected model, its scope and its responsibilities are formalised in the project security documentation.
Cross-cutting controls
Documents, metadata, search indexes and operations are attached to the client's scope. In SaaS, isolation is logical; a VPC or on-premise deployment adds infrastructure isolation according to the selected architecture.
Covers: tenant boundaries, storage, indexes and processing jobs.
Application exchanges are protected in transit and stored data is encrypted at rest according to the deployment architecture. Exact mechanisms and key management are described during the technical review.
Covers: protocols, termination, encrypted scope and key ownership.
Permissions limit access according to role and working scope. Identity, SSO or IAM integrations and administrative privileges are defined for the client's environment.
Covers: roles, least privilege, account lifecycle and administrative access.
Access and sensitive business events can be recorded to connect an action to its user and context. Scope, retention and access to logs depend on the agreed deployment.
Covers: covered events, timestamps, retention, export and monitoring.
Use of data
The Mirmi engine is proprietary. It orchestrates self-hosted open-source models and software components selected, configured and integrated into Mirmi's own processing pipeline.
One client's agreements, decisions and corrections are not used to train a model shared across customers, enrich another client's answers or train a third-party model. Data spaces and indexes remain attached to their original scope.
The deployment model determines the processing scope: Mirmi operates the French SaaS environment, while dedicated VPC and on-premise extend customer control.
For each deployment, technical services, integrations, any subprocessors, data-flow destinations and retention periods are documented.
Processing boundary
A readable path for every data item
Origin, destination, purpose and responsible party are documented at every stage.
Shared responsibility
For each deployment model, Mirmi, customer and shared responsibilities are defined before production.
Security of the supplied code and services, remediation of product vulnerabilities, application access controls and documentation of the operated scope.
Management of internal users and rights, security of endpoints and connected sources, data qualification and approval of retention rules.
Network configuration, SSO/IAM, monitoring, incident response, backups and updates according to the responsibilities defined for the selected model.
Security questions
Mirmi SaaS and customer data are hosted in France by Scaleway, in the fr-par region. A dedicated VPC or on-premise deployment can also be selected; the chosen model defines the scope of control, data flows and shared responsibilities.
Documents, metadata, indexes and operations are attached to the client's tenant. In SaaS, separation is logical and enforced by the application and data layer; a dedicated environment can add infrastructure separation.
Exchanges are protected in transit and stored data is encrypted at rest according to the proposed architecture. Protocols, exact scope and responsibility for key management are detailed during the security review.
No. One client's documents and decisions are not used to train a model shared across customers, enrich another client's answers or train a third-party model. Processing required to provide the service and its location remain documented for the selected deployment.
The Mirmi engine is proprietary. It builds on self-hosted open-source models and software components that Mirmi selects, configures and integrates into its own processing pipeline. The components and data flows actually involved are specified for the selected architecture.
The engine’s open-source models are self-hosted within the intended perimeter. Integrations, technical services, any subprocessors and required data flows are made explicit for the selected architecture.
Mirmi documents the architecture, data flows, encryption, roles, logging and shared responsibilities. The exact list of available documents and evidence is confirmed during the security review.
Security review
Share your location, identity, network, encryption and audit requirements. Together, we define the deployment model and associated responsibilities.
Mirmi