Security architecture
Minimal data by design, TLS at the public edge, encrypted storage — and honest about the internal boundary.
Where your data lives, how it's protected, and what's still on the roadmap
The architectural claim
Mimiq uses simulated personas instead of recruiting a participant panel. A standard test does not install a tracker on your product or observe real end users. Mimiq still processes your account details and the URLs, prompts, uploads, and optional customer rows you choose to submit.
Less data is a useful architectural choice, not a compliance exemption. Under EU guidance, information about an identifiable person — including data that is merely pseudonymised — remains personal data. Do not submit personal data unless you are authorised to process it and it is necessary for the test. European Commission guidance
What data we handle
An honest inventory of every byte that touches our system
Your account info
Personal data (yours)
Email, name, billing details, credit balance
Processed to provide the service. Deleted with your account.
URLs you test
Confidential; may contain personal data
Publicly reachable website or prototype URLs, screenshots, and other content you submit for testing
Processed to run the test and produce a report. Avoid private URLs or embedded personal data unless you are authorised to submit them.
Prompts you submit
Confidential; may contain personal data
Your test questions, goals, audience descriptions
Used to run the test. Prompts may be sent to model providers through AWS Bedrock. Do not include unnecessary personal or sensitive data.
Optional customer imports
May be personal data
Rows you upload from analytics, CRM, billing, or research tools
You control whether to use this feature and must have a lawful basis. Minimise or remove direct identifiers before upload whenever possible.
Synthetic persona profiles
Designed to be fictional
Demographically generated participants (name, age, occupation, traits)
Generated from aggregate priors and model output, not recruited from a participant panel. Do not treat a persona as a real individual.
Simulation results
Model output; may reflect submitted content
What synthetic personas 'said' about your test content
Not a real participant voice. Because output can quote or transform your input, handle the report at the same sensitivity as the source material.
Your end users
Not observed by default
The real people who visit your website or use your product
Mimiq does not install an end-user tracker for a standard test. If you upload customer data or expose it in a tested page, that data enters the processing scope.
Launch architecture
The AWS production path; final deployment canary still required
┌──────────────────────┐ HTTPS/TLS ┌──────────────────────┐
│ You (browser) │──────────────▶│ CloudFront │
└──────────────────────┘ │ S3 + same-origin API │
└──────────┬───────────┘
│ HTTP origin hop
│ CloudFront prefix list
│ + secret origin header
▼
┌──────────────────────┐
│ ALB → ECS API │
│ + SQS worker │
└──────────┬───────────┘
│
┌───────────────────┼───────────────────┐
▼ ▼ ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ AWS Bedrock │ │ DynamoDB │ │ Stripe + Clerk │
│ model inference │ │ retained records │ │ billing + auth │
└──────────────────┘ └──────────────────┘ └──────────────────┘
Plainly: one CloudFront distribution fronts separate S3 and API origins. TLS terminates at CloudFront. The documented CloudFront-to-ALB origin connection uses HTTP, while ALB ingress is restricted to the AWS-managed CloudFront prefix list and requests must carry a secret origin header. ECS runs the API and browser worker, DynamoDB stores records, and AWS Bedrock US inference profiles run model calls. Stripe handles card entry and Clerk handles identity. This diagram is the deployment contract, not proof of a completed audit: the final public Page, Ask, Flow, share, and failure-path canaries must pass before production traffic is invited.
Security posture
Implemented controls and the verification still required
Encryption at rest
Implemented; canary pending
DynamoDB with AWS-managed encryption (AES-256). Stripe handles all payment data (PCI DSS certified) — card numbers never touch our systems.
Encryption in transit
Edge TLS configured; canary pending
The public browser-to-CloudFront edge uses HTTPS/TLS, as do outbound provider API calls. TLS terminates at CloudFront; the CloudFront-to-ALB origin hop uses HTTP and is restricted by the AWS-managed CloudFront prefix list plus a secret origin header.
Authentication
Configured; canary pending
Clerk for identity and session management. No passwords stored on our infrastructure.
Access control
Hardened; release test required
Owner and verified-organization checks cover sessions, projects, audiences, simulations, and report generation. Cross-tenant tests are a required release gate.
Vulnerability disclosure
Contact available
Report issues to security@mimiqai.com. Critical reports are acknowledged and prioritized immediately.
Sub-processors
Available on request
AWS/Bedrock (infrastructure and inference), Stripe (billing), and Clerk (identity), plus any current delivery providers. Current list and applicable terms are available on request.
Roadmap
What we have not built yet — listed here instead of claimed above
MFA enforcement
Planned
Identity runs on Clerk, which supports MFA. Account-wide MFA enforcement is planned; it is not enforced today.
SOC 2
Planned
On the roadmap as the customer base grows. No audit has started — we say that plainly rather than claim 'in progress'.
Penetration testing
Planned
Third-party penetration test planned. None completed yet.
Audit logs
Planned
Structured, exportable audit logging is planned. Standard infrastructure logs exist today.
EU inference option
Planned
Bedrock inference via EU regions for customers that require EU processing. On the roadmap.
What the synthetic-participant model changes
No participant recruitment records
A standard Mimiq test does not collect participant names, contact details, consent records, screen recordings, or panel payments because no real panel is recruited.
Customer content still matters
URLs, prompts, uploads, and optional customer imports may be confidential or personal data. They still require minimisation, access controls, retention rules, and an appropriate lawful basis.
Directional evidence, not human research
The smaller participant-data footprint comes with a clear boundary: simulated reactions diagnose likely confusion and disagreement; they do not become human-subject evidence.
Get the docs
For procurement teams, security reviewers, DPOs
Data Processing Agreement (DPA)
Request current processor terms and DPA status before submitting personal data
Request →
Sub-processor list
Request the current provider list, processing locations, and applicable terms
Request →
Architecture overview
Data flows, storage, encryption, and inference paths
Request →
Compliance roadmap
SOC 2, pentest, and MFA plans with current status
Request →
Questions?
security@mimiqai.com · victor@mimiqai.com · We aim to reply within two business days