Where your data lives
Mia's platform, including its databases, call recordings and files, runs on our own servers in Germany (EU).
Some providers Mia relies on process data in the USA: OpenAI for AI, Twilio for calls and SMS, Firecrawl for importing customer websites, Cloudflare for our website and network edge, and Google Calendar for calendar sync (in the customer's own Google account).
SepNets Fleet runs on the Fleet platform provider's servers in the USA.
Encryption in transit
All connections (the website, the dashboard, the chat widget, and the call audio between our phone provider and our servers) are encrypted with TLS.
Backups
We back up the platform every night. Backups are encrypted before they leave our server and are stored with a provider in Germany for 30 days.
Automatic deletion
Call recordings, transcripts and AI summaries are automatically deleted 90 days after the call.
Chat messages follow the subscription retention described in our Privacy Policy.
When a Mia subscription ends, business data is deleted within 30 days (after a 7-day grace period to export). In Fleet, GPS location history is deleted automatically after 10 days, and other business data within 30 days of the customer's written request.
Each business's data is separate
Every business's data is isolated at the database level (row-level security), so no business can see another's calls or contacts.
Access for our own staff is limited to named accounts on locked-down servers, and we access customer data only to provide support you request or to operate the service.
Signing in to the dashboard
Dashboard access uses unique accounts, with scrypt-hashed passwords and single sign-on through our identity provider.
Sign-in is rate-limited, and sessions use secure cookies. Password resets are confirmed with a one-time code sent by email.
AI and transparency
Every Mia call opens with a spoken notice that the call is recorded and answered by AI. Businesses can customize the wording of that notice, but it cannot be removed. The chat always shows when the AI is answering.
Under OpenAI's API terms, data sent via the API is not used to train OpenAI's models, and SepNets never uses customer data to train any model.
Payments
We never see or store your card details. Payments run through our invoicing provider, Green Invoice (Morning).
Our servers
Our servers are locked down: traffic reaches them only through Cloudflare, administrative access is key-only over a private network, the firewall denies everything else by default, and security updates install automatically.
Your controls
From the dashboard you can export all of your business data as a ZIP (download link valid 7 days).
If you cancel, you get a 7-day grace period to export, then everything is deleted within 30 days.
In SepNets Fleet, data can be exported screen by screen (Excel or PDF).
Report a security issue
Email us with what you found and how to reproduce it. We'll get back to you.
Read our Privacy Policy and our Accessibility statement.