# Security & Trust

How Mihu approaches security, privacy and responsible customer-conversation workflows.

GDPR Privacy program

KVKK Privacy program

256-bit Encryption

Support Security questions

## Security Features

We employ multiple layers of security to ensure your data is always protected.

### Access Control

Role-based access control (RBAC) ensures team members only access what they need. Multi-factor authentication adds an extra layer of protection.

### Secure Infrastructure

Hosted on certified data centers with 24/7 monitoring, redundant systems, and automatic failover capabilities for maximum reliability.

### Security Audits

Regular third-party penetration testing and security audits ensure our systems meet the highest security standards.

### Incident Response

Documented incident response procedures with 24/7 security team monitoring. Rapid detection and response to potential threats.

### Data Backup

Automated daily backups with point-in-time recovery. Geographic redundancy ensures your data is always safe and recoverable.

## Privacy & regulatory requirements

Your organization remains responsible for assessing the legal and contractual requirements that apply to its use of Mihu.

GDPR

#### GDPR

Review our Privacy Policy and contact us to discuss data-processing requirements for your organization.

KVKK

#### KVKK

Organizations operating in Türkiye should assess their own KVKK obligations and implementation requirements.

HIPAA

#### HIPAA

Healthcare customers should contact Mihu before processing protected health information to assess their specific requirements.

## Data Protection

We take a comprehensive approach to protecting your data throughout its lifecycle:

### Data Collection

We only collect data necessary to provide our services

Clear consent mechanisms for data collection

Transparent privacy policies and data practices

### Data Storage

All data encrypted at rest using AES-256

Secure, redundant storage across multiple data centers

Regular integrity checks and validation

Configurable data retention policies

### Data Access

Role-based access control (RBAC)

Multi-factor authentication (MFA)

Session management and automatic timeouts

Comprehensive audit logging

### Data Deletion

Right to erasure (GDPR & KVKK compliance)

Secure data deletion procedures

Automated purging based on retention policies

Verification of complete data removal

## Network Security

Firewalls: Enterprise-grade firewalls with intrusion detection and prevention

DDoS Protection: Automatic mitigation of distributed denial-of-service attacks

WAF: Web Application Firewall to protect against common vulnerabilities

VPN: Secure VPN access for administrative operations

Network Segmentation: Isolated environments for different services and data types

## Application Security

Secure Development: Security-first development practices and code reviews

Vulnerability Scanning: Automated scanning for known vulnerabilities

Penetration Testing: Regular third-party security assessments

Bug Bounty Program: Responsible disclosure program for security researchers

Dependency Management: Continuous monitoring of third-party components

## Business Continuity

High Availability: 99.99% uptime SLA with redundant systems

Disaster Recovery: Comprehensive DR plan with regular testing

Geographic Redundancy: Data replicated across multiple regions

Backup & Recovery: Automated backups with point-in-time recovery

## Security Reporting

If you discover a security vulnerability, please report it responsibly:

Email: security@mihu.ai

Do not publicly disclose the vulnerability until we've addressed it

Provide detailed information to help us reproduce and fix the issue

We commit to acknowledging reports within 24 hours

## Have Security Questions?

Our security team is here to help. Contact us for more information about our security practices.

Contact Security Team (https://mihu.ai/contact) View Privacy Policy (https://mihu.ai/privacy)