Mizu publishes only controls and programs we can demonstrate in the product or contracts. We do not display third-party certification badges (SOC 2, ISO 27001, etc.) until an independent attestation is complete.
Qualified claims only: 4 residual row(s) still open (see enterprise claims matrix).
See the Trust Center for implemented controls, subprocessors, and the claims matrix.
SOC 2 Type II
Security, availability, and confidentiality controls are implemented in-product. Independent SOC 2 Type II attestation is on the roadmap - we do not claim certification until complete.
Controls we implement today
These in-product controls align with common SOC 2 trust service criteria. They are not a substitute for an independent attestation report.
Organization-scoped data isolation (RLS)
Supabase row-level security policies enforce tenant isolation using org context (e.g. get_my_org_id()) on CRM and usage tables.
Application-layer encryption for sensitive fields
Integration secrets and telephony credentials are encrypted at the application layer before persistence (AES-256-GCM via lib/security/piiEncryption).
Encryption in transit
All customer-facing application traffic is served over HTTPS/TLS. External webhooks (e.g. Stripe) require signed payloads.
Role-based access control
Dashboard and API routes enforce permission checks (withPermission) before data access or mutations.
Audit logging
Security-relevant actions are recorded in org-scoped audit logs with settings UI for review.
Request documentation
When our SOC 2 Type II report is available, enterprise customers may request it under NDA. Until then, use the Trust Center for our current controls and subprocessors list.