Security & trust
Security built for the people who answer to the auditor.
MiMs holds the record of what happened across your operation — incidents, investigations, evidence, compliance. That record has to be protected, access-controlled and provable. We publish only what we can stand behind: hosted in South Africa for data residency, encryption in transit and at rest, SSO in production, role-based access and an immutable audit trail. Where a formal certification would normally sit, our controls are documented and available on request.
Hosted in South Africa (POPIA data residency) · Encryption in transit & at rest · SSO shipped and in use · Role-based access · Immutable audit trail · Backups & disaster recovery
The controls
Named controls, not vague reassurance
Single sign-on
SSO is shipped and in use. Authenticate through your own identity provider and enforce your MFA and access policy centrally.
Role-based access
Access is granted by role, function and site, so people see only what their job requires — down to sensitive investigation files.
Encryption
Data is encrypted in transit and at rest using industry-standard protocols across the platform.
Immutable audit trail
Every action is time-stamped and tamper-evident, giving you a defensible record of who did what and when.
Retention & deletion
Configurable retention and deletion rules let you align data lifecycles to your own policy and legal obligations.
Backups & recovery
Regular backups and documented disaster-recovery procedures keep your operational record available and restorable.
Access
- SSO via your identity provider (in production)
- Role-based access down to function and site
- Least-privilege defaults for sensitive files
Data
- Hosted in South Africa for POPIA residency
- Encrypted in transit and at rest
- Configurable retention and deletion
Evidence
- Immutable, time-stamped audit trail
- Tamper-evident record of every action
- Defensible chain for hearings and audits
Resilience
- Regular backups
- Documented disaster-recovery procedures
- Offline-first capture so the field never loses data
We publish only what we can prove
You will not find a certification badge here that we cannot back up. SSO is shipped and in use. Our security controls are documented and available on request under NDA, and any certification that is in progress is described honestly as in progress — never claimed as complete.
If a control you need is not listed, ask. We would rather tell you exactly where we stand than imply more than we can show.
Questions we get from security teams
Security FAQ
Where is our data hosted?
In South Africa, supporting POPIA data residency. Your operational record stays in-country.
Do you support single sign-on?
Yes. SSO is shipped and in use in production. You authenticate through your own identity provider and enforce MFA and access policy centrally.
Is the data encrypted?
Yes — in transit and at rest, using industry-standard encryption across the platform.
Are you certified to a formal standard?
We publish only verifiable claims. Our controls are documented and available for review on request. Where a certification is in progress we say so plainly rather than implying it is complete.
Can we review your controls before buying?
Yes. Our procurement kit gathers the security overview, POPIA statement, SLA terms, DPA and backup summary for your security and procurement teams.
Put our controls in front of your security team
Book a walkthrough, or request the procurement kit for a documented review.
Book a demo