Trust & transparency

Synthetic participants reduce the data footprint. They do not erase your obligations.

How Mimiq handles your data, your users' data, and your trust

The architectural claim

Mimiq uses simulated personas instead of recruiting a participant panel. A standard test does not install a tracker on your product or observe real end users. Mimiq still processes your account details and the URLs, prompts, uploads, and optional customer rows you choose to submit.

Less data is a useful architectural choice, not a compliance exemption. Under EU guidance, information about an identifiable person, including data that is merely pseudonymised, remains personal data. Do not submit personal data unless you are authorised to process it and it is necessary for the test. European Commission guidance

What data we handle

An honest inventory of every byte that touches our system

Your account infoEmail, name, billing details, credit balance
Processed to provide the service. Deleted with your account.
Personal data (yours)
URLs you testPublicly reachable website or prototype URLs, screenshots, and other content you submit for testing
Processed to run the test and produce a report. Avoid private URLs or embedded personal data unless you are authorised to submit them.
Confidential; may contain personal data
Prompts you submitYour test questions, goals, audience descriptions
Used to run the test. Prompts may be sent to model providers through AWS Bedrock and, in flows, to a contracted model provider. Do not include unnecessary personal or sensitive data.
Confidential; may contain personal data
Optional customer importsRows you upload from analytics, CRM, billing, or research tools
You control whether to use this feature and must have a lawful basis. Minimise or remove direct identifiers before upload whenever possible.
May be personal data
Synthetic persona profilesDemographically generated participants (name, age, occupation, traits)
Generated from aggregate priors and model output, not recruited from a participant panel. Do not treat a persona as a real individual.
Designed to be fictional
Simulation resultsWhat synthetic personas 'said' about your test content
Not a real participant voice. Because output can quote or transform your input, handle the report at the same sensitivity as the source material.
Model output; may reflect submitted content
Your end usersThe real people who visit your website or use your product
Mimiq does not install an end-user tracker for a standard test. If you upload customer data or expose it in a tested page, that data enters the processing scope.
Not observed by default

Launch architecture

The AWS production path; final deployment canary still required

You (browser)

HTTPS/TLS

CloudFrontS3 + same-origin API

HTTP origin hopCloudFront prefix list+ secret origin header

ALB → ECS API+ SQS worker

AWS Bedrockmodel inference

DynamoDBretained records

Stripe + Cognitobilling + auth

Plainly: one CloudFront distribution fronts separate S3 and API origins. TLS terminates at CloudFront. The documented CloudFront-to-ALB origin connection uses HTTP, while ALB ingress is restricted to the AWS-managed CloudFront prefix list and requests must carry a secret origin header. ECS runs the API and browser worker, DynamoDB stores records, and AWS Bedrock US inference profiles run model calls. Stripe handles card entry and Amazon Cognito handles accounts. This diagram is the deployment contract, not proof of a completed audit: the final public Page, Ask, Flow, share, and failure-path canaries must pass before production traffic is invited.

What the synthetic-participant model changes

No participant recruitment records

A standard Mimiq test does not collect participant names, contact details, consent records, screen recordings, or panel payments because no real panel is recruited.

Customer content still matters

URLs, prompts, uploads, and optional customer imports may be confidential or personal data. They still require minimisation, access controls, retention rules, and an appropriate lawful basis.

Directional evidence, not human research

The smaller participant-data footprint comes with a clear boundary: simulated reactions diagnose likely confusion and disagreement; they do not become human-subject evidence.

Get the docs

For procurement teams, security reviewers, DPOs

Data Processing Agreement (DPA)Request current processor terms and DPA status before submitting personal dataRequest Sub-processor listRequest the current provider list, processing locations, and applicable termsRequest Architecture overviewData flows, storage, encryption, and inference pathsRequest Compliance roadmapSOC 2, pentest, and MFA plans with current statusRequest

Questions?

security@mimiqai.com · victor@mimiqai.com · We aim to reply within two business days

Start free