Security, privacy & compliance
This page lists controls we implement in the Mizu product and subprocessors we rely on. We do not publish certification claims until an independent attestation is complete.
Mizu publishes only controls and programs we can demonstrate in the product or contracts. We do not display third-party certification badges (SOC 2, ISO 27001, etc.) until an independent attestation is complete.
Qualified claims only: 4 residual row(s) still open (see enterprise claims matrix).
Enterprise claims matrix
- SMB / standard CRM productionEng: COMPLETE · Ops: COMPLETE · Unqualified OK
- Production SAML SSO readyEng: COMPLETE · Ops: PENDING · Qualified only
- Counsel-approved DPAEng: PARTIAL · Ops: PENDING · Qualified only
- Independent uptime / physical DREng: PARTIAL · Ops: PENDING · Qualified only
- Independent accessibility / pen-test attestationEng: PARTIAL · Ops: PENDING · Qualified only
- Runtime RLS COMPLETEEng: COMPLETE · Ops: COMPLETE · Unqualified OK
Last updated: October 16, 2026
Compliance programs
Status reflects what we can demonstrate today - not aspirational certifications.
SOC 2 Type II
Certification in progressSOC 2-aligned controls (certification in progress)
Security, availability, and confidentiality controls are implemented in-product. Independent SOC 2 Type II attestation is on the roadmap - we do not claim certification until complete.
ISO 27001
Certification in progressISO 27001-aligned ISMS (certification in progress)
Information security practices follow ISO 27001-style control areas. Formal certification is not yet complete.
GDPR
Controls implementedGDPR support (DPA, export, requests)
Data processing agreements, export tooling, and org-scoped GDPR request handling are available. Compliance is an ongoing program, not a one-time certificate.
HIPAA
Enterprise (on request)HIPAA-ready configurations (Enterprise, on request)
Enterprise customers may request BAA and hardened configurations. Mizu does not claim HIPAA certification for all tenants by default.
Implemented controls
Each control maps to code, migrations, or settings in the Mizu application.
Access control
Role-based access control
Dashboard and API routes enforce permission checks (withPermission) before data access or mutations.
MFA and SSO (SAML)
Organizations can enforce MFA. SAML SSO packaging is available; production IdP sign-off is in progress (not full OAuth CRUD SSO).
Encryption
Application-layer encryption for sensitive fields
Integration secrets and telephony credentials are encrypted at the application layer before persistence (AES-256-GCM via lib/security/piiEncryption).
Encryption in transit
All customer-facing application traffic is served over HTTPS/TLS. External webhooks (e.g. Stripe) require signed payloads.
Tenant isolation
Organization-scoped data isolation (RLS)
Supabase row-level security policies enforce tenant isolation using org context (e.g. get_my_org_id()) on CRM and usage tables.
Audit & logging
Audit logging
Security-relevant actions are recorded in org-scoped audit logs with settings UI for review.
Privacy
GDPR data export and request workflows
Authenticated export endpoints and compliance APIs support data subject request handling (export / org-scoped GDPR request tracking).
Operations
Telephony usage metering
Org-keyed usage_events table records telephony and billing-related usage with RLS.
Backup & disaster recovery
Daily Supabase backups with documented restore procedure, quarterly staging drills, and published RTO/RPO (4h / 24h).
Subprocessors
Third-party services that process customer data on our behalf. Links point to each vendor's security documentation. Download the current PDF list: subprocessors.pdf. Authentication is Supabase Auth exclusively.
| Vendor | Purpose | Security |
|---|---|---|
| Supabase | Primary database, authentication, and file storage | Docs |
| Stripe | Subscription billing and payments | Docs |
| Telnyx | SMS/voice telephony and phone number inventory | Docs |
| Vercel | Application hosting and edge delivery | Docs |
| Sentry | Error monitoring (when configured) | Docs |
| Resend | Transactional and product email delivery | Docs |
| OpenAI | LLM inference for AI features (when configured) | Docs |
| Anthropic | LLM inference for AI features (when configured) | Docs |
| Google (Gemini) | LLM inference for AI features (when configured) | Docs |
| Upstash | Redis rate limiting and operational counters | Docs |
| Metabase | Optional self-hosted BI embeds for enterprise analytics | Docs |
| Better Stack | Public status page and uptime monitoring | Docs |
Backup & disaster recovery
Recovery objectives for the Supabase primary database. Targets reflect our internal SLA; observed figures are from the latest quarterly staging restore drill when available.
RTO (target)
4 hours
Recovery Time Objective - max downtime
RPO (target)
24 hours
Recovery Point Objective - max data loss
RTO (observed)
1 minutes
Measured 2026-10-05 (2026-Q3 drill)
RPO (observed)
0 hours
Derived from daily backup cadence - drill 2026-10-05-logical-restore
- Backups: Daily (Supabase automated backups)
- PITR: 7 days (point-in-time recovery, Pro plan)
- Drills: Quarterly restore to staging (Jan, Apr, Jul, Oct)
- Last updated: 2026-08-22
- Formal restore attestation (FIX-09):
documentation/compliance/dr-attestations/provided on enterprise security review request
Latest DR drill
2026-10-05 - staging (backup restore): Restore completed in 1 minutes via CREATE TABLE AS isolated schema copy on source DB, then DROP SCHEMA (production data unchanged). Observed RPO 0h. Post-restore verification passed.