Security architecture
Minimal data by design, TLS at the public edge, encrypted storage, and an honest account of the internal boundary.
Where your data lives, how it's protected, and what's still on the roadmap
The architectural claim
Mimiq uses simulated personas instead of recruiting a participant panel. A standard test does not install a tracker on your product or observe real end users. Mimiq still processes your account details and the URLs, prompts, uploads, and optional customer rows you choose to submit.
Less data is a useful architectural choice, not a compliance exemption. Under EU guidance, information about an identifiable person, including data that is merely pseudonymised, remains personal data. Do not submit personal data unless you are authorised to process it and it is necessary for the test. European Commission guidance
What data we handle
An honest inventory of every byte that touches our system
- Your account infoEmail, name, billing details, credit balance
Processed to provide the service. Deleted with your account.
Personal data (yours) - URLs you testPublicly reachable website or prototype URLs, screenshots, and other content you submit for testing
Processed to run the test and produce a report. Avoid private URLs or embedded personal data unless you are authorised to submit them.
Confidential; may contain personal data - Prompts you submitYour test questions, goals, audience descriptions
Used to run the test. Prompts may be sent to model providers through AWS Bedrock and, in flows, to a contracted model provider. Do not include unnecessary personal or sensitive data.
Confidential; may contain personal data - Optional customer importsRows you upload from analytics, CRM, billing, or research tools
You control whether to use this feature and must have a lawful basis. Minimise or remove direct identifiers before upload whenever possible.
May be personal data - Synthetic persona profilesDemographically generated participants (name, age, occupation, traits)
Generated from aggregate priors and model output, not recruited from a participant panel. Do not treat a persona as a real individual.
Designed to be fictional - Simulation resultsWhat synthetic personas 'said' about your test content
Not a real participant voice. Because output can quote or transform your input, handle the report at the same sensitivity as the source material.
Model output; may reflect submitted content - Your end usersThe real people who visit your website or use your product
Mimiq does not install an end-user tracker for a standard test. If you upload customer data or expose it in a tested page, that data enters the processing scope.
Not observed by default
Launch architecture
The AWS production path; final deployment canary still required
Security posture
Implemented controls and the verification still required
- Encryption at rest
DynamoDB with AWS-managed encryption (AES-256). Stripe handles all payment data (PCI DSS certified), so card numbers never touch our systems.
Implemented; canary pending - Encryption in transit
The public browser-to-CloudFront edge uses HTTPS/TLS, as do outbound provider API calls. TLS terminates at CloudFront; the CloudFront-to-ALB origin hop uses HTTP and is restricted by the AWS-managed CloudFront prefix list plus a secret origin header.
Edge TLS configured; canary pending - Authentication
Amazon Cognito for accounts and sessions. Passwords are hashed by Cognito and never stored by Mimiq.
Configured; canary pending - Access control
Owner and verified-organization checks cover sessions, projects, audiences, simulations, and report generation. Cross-tenant tests are a required release gate.
Hardened; release test required - Vulnerability disclosure
Report issues to security@mimiqai.com. Critical reports are acknowledged and prioritized immediately.
Contact available - Sub-processors
AWS/Bedrock (infrastructure, accounts and inference), a contracted model provider (the steps people take in a flow) and Stripe (billing), plus any current delivery providers. Current list and applicable terms are available on request.
Available on request
Roadmap
What we have not built yet, listed here instead of claimed above
- MFA enforcement
Accounts run on Amazon Cognito, which supports MFA. MFA is planned; it is not offered today.
Planned - SOC 2
On the roadmap as the customer base grows. No audit has started; we say that plainly rather than claim 'in progress'.
Planned - Penetration testing
Third-party penetration test planned. None completed yet.
Planned - Audit logs
Structured, exportable audit logging is planned. Standard infrastructure logs exist today.
Planned - EU inference option
Bedrock inference via EU regions for customers that require EU processing. On the roadmap.
Planned
What the synthetic-participant model changes
No participant recruitment records
A standard Mimiq test does not collect participant names, contact details, consent records, screen recordings, or panel payments because no real panel is recruited.
Customer content still matters
URLs, prompts, uploads, and optional customer imports may be confidential or personal data. They still require minimisation, access controls, retention rules, and an appropriate lawful basis.
Directional evidence, not human research
The smaller participant-data footprint comes with a clear boundary: simulated reactions diagnose likely confusion and disagreement; they do not become human-subject evidence.
Get the docs
For procurement teams, security reviewers, DPOs
Questions?
security@mimiqai.com · victor@mimiqai.com · We aim to reply within two business days