Security

Built to pass the strictest enterprise review. Every time.

Built to pass the strictest enterprise review. Every time.

Built to pass the strictest enterprise review. Every time.

Questions about security? Talk to our team.

Contracts contain your most sensitive commercial information - deal terms, obligations, liabilities, counterparty data. Miramis is the system of record for all of it. We've built the data privacy and security infrastructure to match that responsibility.

Get a demo

Get a demo

Certified & compliant

Certified & compliant

Certified & compliant

Certified & compliant

ISO 27001

Our Information Security Management System is certified under ISO/IEC 27001 - the internationally recognised standard for information security management. All Miramis security measures are built on this foundation.

SOC 2 Type II

We are SOC 2 Type II certified, demonstrating that we manage data in accordance with the five trust service principles: security, availability, processing integrity, confidentiality, and privacy.

GDPR compliant

Our use and processing of data are compliant with the EU General Data Protection Regulation. With our technical team based in Sweden, GDPR compliance is built into how we operate.

eIDAS-compliant eSigning

Our native eSigning meets EU legal standards for electronic signatures across all member states.

ISO 27001

Our Information Security Management System is certified under ISO/IEC 27001 - the internationally recognised standard for information security management. All Miramis security measures are built on this foundation.

SOC 2 Type II

We are SOC 2 Type II certified, demonstrating that we manage data in accordance with the five trust service principles: security, availability, processing integrity, confidentiality, and privacy.

GDPR compliant

Our use and processing of data are compliant with the EU General Data Protection Regulation. With our technical team based in Sweden, GDPR compliance is built into how we operate.

eIDAS-compliant eSigning

Our native eSigning meets EU legal standards for electronic signatures across all member states.

How we prevent unauthorised access

How we prevent unauthorised access

How we prevent unauthorised access

How we prevent unauthorised access

Data encryption

Customer data at rest is encrypted with AES-256. Data in transit is encrypted with TLS 1.2. Encryption integrity is monitored through periodic risk assessments and annual third-party penetration tests.

Access control

We follow the principle of least privilege - role-based permissions and multi-factor authentication for all systems containing confidential data. Authorised users only have access to data relevant to their access rights. Routine vulnerability scanning, malicious activity detection, and automatic blocking of suspicious behaviour keep your data protected at all times. Firewalls segregate unwanted traffic from the network.

Annual penetration testing

Every year, an independent third party conducts penetration testing across the full scope of the Miramis platform. Findings are used to continuously strengthen our security posture.

Advanced permissions

Role-based access is configurable down to document level. Administrators control exactly who can see what across the platform.

Enterprise SSO

Integrates with your existing identity provider - no separate credentials to manage.

Your data, your control

Your data, your control

Your data, your control

Your data, your control

1

No foundation model training

No foundation model training

Your confidential data is never used to train or fine-tune any AI models. This applies to Miramis and to all AI subprocessors we work with - it is contractually prohibited across all subprocessor agreements.

2

Sub-processor standards

Sub-processor standards

We carefully vet suppliers during procurement and only engage them for specific, necessary purposes. We require all critical sub-processors to meet ISO 27001 standards or equivalent, and maintain GDPR compliance. Every supplier signs NDAs and relevant regulatory agreements before access is granted. We regularly monitor supplier access rights and compliance with their obligations.

1

No foundation model training

No foundation model training

Your confidential data is never used to train or fine-tune any AI models. This applies to Miramis and to all AI subprocessors we work with - it is contractually prohibited across all subprocessor agreements.

2

Sub-processor standards

Sub-processor standards

We carefully vet suppliers during procurement and only engage them for specific, necessary purposes. We require all critical sub-processors to meet ISO 27001 standards or equivalent, and maintain GDPR compliance. Every supplier signs NDAs and relevant regulatory agreements before access is granted. We regularly monitor supplier access rights and compliance with their obligations.

3

Staff security

Staff security

All personnel sign confidentiality agreements and acknowledge compliance with our confidentiality and privacy policies. Mandatory annual security training for every employee. Operations are safeguarded through active monitoring, updated antivirus and spam filters, and timely installation of security patches.

4

Risk management

Risk management

We conduct periodic reviews and assessments of risks, monitor compliance with internal policies and procedures, and maintain an up-to-date risk mapping signed off by senior management.

3

Staff security

Staff security

All personnel sign confidentiality agreements and acknowledge compliance with our confidentiality and privacy policies. Mandatory annual security training for every employee. Operations are safeguarded through active monitoring, updated antivirus and spam filters, and timely installation of security patches.

4

Risk management

Risk management

We conduct periodic reviews and assessments of risks, monitor compliance with internal policies and procedures, and maintain an up-to-date risk mapping signed off by senior management.

How we ensure business continuity

How we ensure business continuity

How we ensure business continuity

How we ensure business continuity

Testing

We perform automated and manual QA assessments for every Miramis release. Our automated testing infrastructure covers 100% of critical user flows and is triggered for every release candidate to manage defects before they reach production.

Data backups

Are performed automatically on a scheduled basis. Our team monitors backup integrity and tests restoration procedures regularly to ensure data can be recovered reliably.

Disaster recovery

Disaster recovery routines are built on AWS resilience capabilities such as region redundancy and automated failover, and are tested at regular intervals based on risk assessments. We define and validate Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) to ensure recovery targets are met. We carry out rigorous IT and management processes when a serious incident occurs and continuously update our processes and routines.

Location independence

All employees can continue working from alternative locations using MFA-protected tools and SSO managed systems. This ensures operations can continue if offices are inaccessible due to an extreme event.

Read our Security Policy

Testing

We perform automated and manual QA assessments for every Miramis release. Our automated testing infrastructure covers 100% of critical user flows and is triggered for every release candidate to manage defects before they reach production.

Data backups

Are performed automatically on a scheduled basis. Our team monitors backup integrity and tests restoration procedures regularly to ensure data can be recovered reliably.

Disaster recovery

Disaster recovery routines follow AWS best practices and are tested at regular intervals based on risk assessments. We carry out rigorous IT and management processes when a serious incident occurs and continuously update our processes and routines.

Location independence

All employees can continue working from alternative locations using MFA-protected tools and SSO managed systems. This ensures operations can continue if offices are inaccessible due to an extreme event.

Frequently Asked Questions

How does Miramis encrypt data?

Customer data at rest is encrypted with AES-256. All data in transit uses TLS 1.2. Encryption integrity is monitored through periodic risk assessments and annual third-party penetration tests.

Does Miramis use our data to train AI models?

No. Your data is never used to train or fine-tune any AI models - by Miramis or by any of our subprocessors. This is contractually prohibited in all subprocessor agreements.

What certifications does Miramis hold?

ISO 27001 and SOC 2 Type II. We are also GDPR-compliant and our eSigning is eIDAS-compliant. Full certification documentation is available on request.

How do you control access to our data?

We follow the principle of least privilege. Role-based permissions mean users only access what they need. Multi-factor authentication is required for all systems containing confidential data. Firewalls segregate unwanted traffic, and suspicious behaviour is blocked automatically.

Can every user see every contract?

No. Access is controlled by role-based permissions configured by your administrators. Authorised users only have access to data relevant to their access rights.

How do you vet sub-processors and suppliers?

All critical sub-processors are required to meet ISO 27001 standards or equivalent and maintain GDPR compliance. Suppliers undergo a thorough security review during procurement, including an assessment of their alignment with ISO 27001 controls as well as a formal risk assessment. Results are documented and tracked in our GRC platform. Suppliers sign NDAs and security agreements before access is granted and are monitored on an ongoing basis.

AI-based contract management software Pocketlaw for businesses of all sizes (small, medium, large), showcasing a user-friendly dashboard that streamlines legal workflow for clients and customers with options to create, review, and upload documents, access templates, and monitor document statistics.

Frequently Asked Questions

How does Miramis encrypt data?

Customer data at rest is encrypted with AES-256. All data in transit uses TLS 1.2. Encryption integrity is monitored through periodic risk assessments and annual third-party penetration tests.

Does Miramis use our data to train AI models?

No. Your data is never used to train or fine-tune any AI models - by Miramis or by any of our subprocessors. This is contractually prohibited in all subprocessor agreements.

What certifications does Miramis hold?

ISO 27001 and SOC 2 Type II. We are also GDPR-compliant and our eSigning is eIDAS-compliant. Full certification documentation is available on request.

How do you control access to our data?

We follow the principle of least privilege. Role-based permissions mean users only access what they need. Multi-factor authentication is required for all systems containing confidential data. Firewalls segregate unwanted traffic, and suspicious behaviour is blocked automatically.

Can every user see every contract?

No. Access is controlled by role-based permissions configured by your administrators. Authorised users only have access to data relevant to their access rights.

How do you vet sub-processors and suppliers?

All critical sub-processors are required to meet ISO 27001 standards or equivalent and maintain GDPR compliance. Suppliers undergo a thorough security review during procurement, including an assessment of their alignment with ISO 27001 controls as well as a formal risk assessment. Results are documented and tracked in our GRC platform. Suppliers sign NDAs and security agreements before access is granted and are monitored on an ongoing basis.

AI-based contract management software Pocketlaw for businesses of all sizes (small, medium, large), showcasing a user-friendly dashboard that streamlines legal workflow for clients and customers with options to create, review, and upload documents, access templates, and monitor document statistics.

Frequently Asked Questions

How does Miramis encrypt data?

Customer data at rest is encrypted with AES-256. All data in transit uses TLS 1.2. Encryption integrity is monitored through periodic risk assessments and annual third-party penetration tests.

Does Miramis use our data to train AI models?

No. Your data is never used to train or fine-tune any AI models - by Miramis or by any of our subprocessors. This is contractually prohibited in all subprocessor agreements.

What certifications does Miramis hold?

ISO 27001 and SOC 2 Type II. We are also GDPR-compliant and our eSigning is eIDAS-compliant. Full certification documentation is available on request.

How do you control access to our data?

We follow the principle of least privilege. Role-based permissions mean users only access what they need. Multi-factor authentication is required for all systems containing confidential data. Firewalls segregate unwanted traffic, and suspicious behaviour is blocked automatically.

Can every user see every contract?

No. Access is controlled by role-based permissions configured by your administrators. Authorised users only have access to data relevant to their access rights.

How do you vet sub-processors and suppliers?

All critical sub-processors are required to meet ISO 27001 standards or equivalent and maintain GDPR compliance. Suppliers undergo a thorough security review during procurement, including an assessment of their alignment with ISO 27001 controls as well as a formal risk assessment. Results are documented and tracked in our GRC platform. Suppliers sign NDAs and security agreements before access is granted and are monitored on an ongoing basis.

AI-based contract management software Pocketlaw for businesses of all sizes (small, medium, large), showcasing a user-friendly dashboard that streamlines legal workflow for clients and customers with options to create, review, and upload documents, access templates, and monitor document statistics.

Questions about security?

Questions about security?

Talk to our team