The trust architecture behind every Mitori engagement.
Mitori was built around a single constraint: enterprise trust is non-negotiable. That means enterprise-grade access controls, you define the observation scope, and a clear retention and auditability model governs all captured data.
Three commitments. No exceptions.
You control what is captured
Full-spectrum observation capabilities including keystrokes, screen recording, document content, and email. You configure which capture surfaces are active. We only observe what access you provide us with. Passwords and credentials are always automatically suppressed.
Data expires automatically
All data is permanently deleted at engagement end plus a 30-day buffer. Clients can trigger immediate deletion at any time. Deletion certificates are provided upon request.
Employees stay in control
Individual informed consent before any observation begins. Opt-out at any time with no consequences. Data excluded from analysis and permanently deletable on request. No manager is notified of individual opt-outs.
What we observe vs. what we cannot access
The distinction is architectural, not policy-based. Understanding this difference is the key to understanding Mitori's security model.
What Mitori observes
Metadata only
- Active application names and window context
- Document titles, metadata, and content (when enabled)
- Time spent per application and task
- Application switching frequency and patterns
- Meeting participation, duration, and conversation context
- Full browser activity including URLs and page content
- Keystroke patterns and data entry workflows
- Screen recording for workflow verification
- Email content, thread structure, and attachments
Always protected
Regardless of access scope configuration
- Passwords, credentials, or authentication tokens
- Personal device activity (only company-managed devices)
- Items outside your configured access scope
“The distinction is architectural, not policy-based.”
Mitori's desktop agent binary does not contain the code paths to capture content. This is not a setting that can be toggled on or off — the capability simply does not exist in the software. A policy can be changed. An architecture cannot be changed without rebuilding and redeploying entirely new software through your IT approval process.
Our consent model
Every employee participating in a Mitori engagement goes through a clear, documented consent flow. Consent is not assumed, implied, or buried in an employment contract.
Organisation-wide communication
Before agent deployment, the organisation sends a clear communication to all participants explaining the purpose, scope, and privacy protections of the Mitori engagement. Mitori provides template communications to support this.
Individual informed consent
Each employee is presented with a detailed consent screen on first launch. It explains exactly what is captured, what cannot be captured, how data will be used, the retention period, and how to withdraw consent. Consent is recorded and auditable.
Opt-out at any time, no consequences
Employees can withdraw consent and uninstall the agent at any point. Their data is immediately excluded from analysis and can be permanently deleted on request. No manager is notified of individual opt-outs.
Anonymisation before analysis
Individual-level data is anonymised before entering the analysis pipeline. Reports show role-level and team-level workflow patterns only. No individual employee is ever identified in deliverables.
GDPR & Legal Basis
For EU/UK engagements, Mitori operates under the employer's legitimate interest basis (GDPR Article 6(1)(f)) with individual employee consent as an additional safeguard. A Data Protection Impact Assessment (DPIA) template is available for your Data Protection Officer.
Data architecture
Security is enforced at every layer — from the agent on the employee's machine to the infrastructure where data is processed and stored.
Encryption in transit
All data transmitted from the desktop agent to Mitori’s infrastructure uses TLS 1.3 encryption. Certificate pinning prevents man-in-the-middle attacks.
Encryption at rest
Data is encrypted at rest using AES-256 encryption in SOC 2-compliant cloud infrastructure. Encryption keys are managed via AWS KMS with automatic rotation.
Data residency
EU-hosted by default (AWS eu-west-1). US and APAC regions available on request to meet data sovereignty requirements.
Retention and deletion
Data is retained only for the duration of the engagement plus a 30-day buffer period. Automatic permanent deletion at expiry. Clients can trigger immediate deletion via written request at any time. Deletion certificates are provided.
Network isolation
Each client’s data is logically isolated at the infrastructure level. No cross-tenant data access is architecturally possible.
Backup and recovery
Encrypted backups follow the same retention and deletion policy as primary data. Backups are permanently deleted on the same schedule.
How data moves through the audit
Four stages. One direction. No individual data survives the anonymisation boundary.
Access-controlled capture
Desktop agent collects metadata only after individual employee consent
Encrypted transit
TLS 1.3 encrypted transmission to SOC 2 infrastructure
Anonymisation boundary
PII stripped, data aggregated to role and team level
Insight delivery
Role and team-level reporting only — no individual identification
The anonymisation boundary is a one-way gate.
Once data passes through, it cannot be traced back to any individual employee. This is enforced architecturally — there is no “undo” button, no admin override, and no way to reverse the process.
Access controls & organisational security
Technical controls are only as strong as the organisation behind them.
Role-based access control
Least-privilege access model. Only authorised Mitori analysts can access client data, and only for the duration of the active engagement.
Audit logging
All data access is logged with timestamp, user identity, and action performed. Logs are immutable and available for client review on request.
Background checks
All Mitori personnel with access to client data undergo background checks prior to engagement.
Security training
Mandatory annual security awareness training for all staff with access to production systems.
Device security
Full-disk encryption, mobile device management, and automatic patching enforced on all Mitori devices.
Incident response
Documented incident response plan with defined SLAs. Clients notified within 72 hours of any confirmed breach, and within 24 hours for high-severity incidents.
Vulnerability management
- Annual third-party penetration testing — report available under NDA
- Continuous automated vulnerability scanning across infrastructure and application layers
- Responsible disclosure programme for external security researchers
- Automated dependency scanning and patching for all production services
Compliance & certifications
Enterprise-grade compliance across jurisdictions.
SOC 2 Type II
In ProgressGDPR
CompliantCCPA
CompliantISO 27001
RoadmapHIPAA BAA
AvailableWe are transparent about where we are in our compliance journey. SOC 2 Type II audit is underway. ISO 27001 is on our 2026 roadmap. We are happy to discuss our current controls in detail with your security team.
Frequently asked questions
The questions your security team, legal department, and employees will ask — answered in detail.
No. This is an architectural impossibility, not a policy promise.
Mitori's desktop agent reads window manager APIs to capture application names and window titles. The agent binary does not contain the code paths required to read file contents, email bodies, message text, clipboard data, or any form of document content. This capability does not exist in the software and cannot be enabled remotely.
No. Content capture is not a toggle or configuration option. Enabling it would require an entirely different agent binary \u2014 one that would need to go through your IT deployment and approval process from scratch. The agent your employees install is incapable of content capture by design.
All data is automatically and permanently deleted at the end of the engagement plus a 30-day buffer period. Clients can request immediate deletion at any time during or after the engagement.
Deletion is irrecoverable. Backups follow the same deletion schedule. A formal deletion certificate is provided upon request confirming all data has been permanently removed from all systems.
No. All data passes through an anonymisation boundary before it enters the analysis pipeline. This is a one-way process \u2014 once data is anonymised, it cannot be traced back to any individual employee.
Deliverables report at the role level and team level only. For example: "The sales team spends an average of 3.2 hours per day in CRM tools" \u2014 never "John Smith spent 4 hours in Salesforce on Tuesday."
Employees can withdraw consent and uninstall the agent at any point during the engagement. Their data is immediately excluded from all analysis. They can request permanent deletion of any data already collected.
No manager or team lead is notified of individual opt-outs. Participation rates are reported only in aggregate (e.g. "87% participation"), never at the individual level.
For EU/UK engagements, Mitori operates under the employer's legitimate interest basis (GDPR Article 6(1)(f)) with individual employee consent as an additional safeguard. A Data Processing Agreement (DPA) is executed before any engagement begins.
We provide a Data Protection Impact Assessment (DPIA) template for your Data Protection Officer. Mitori supports all individual rights under GDPR including access, rectification, erasure, and data portability.
By default, all data is hosted in AWS eu-west-1 (Ireland). For organisations with specific data sovereignty requirements, US and APAC hosting regions are available on request.
Data never leaves the designated region. All processing, storage, and backup occur within the same geographic boundary.
No. Mitori has not experienced any confirmed data breaches to date. We maintain a documented incident response plan with defined SLAs, and clients would be notified within 72 hours of any confirmed breach (24 hours for high-severity incidents) in accordance with GDPR Article 33 requirements.
Yes. We support multiple levels of security review:
- Third-party penetration test reports (available under NDA)
- SOC 2 Type II report (available upon completion of audit)
- Completed security questionnaires (SIG Lite, CAIQ, or custom formats)
- Live security architecture walkthrough with our engineering team
- Custom due diligence requests for enterprise procurement
The agent is a lightweight process that reads operating system window manager APIs (NSWorkspace on macOS, Win32 API on Windows) to determine the active application name and window title. It measures keyboard and mouse activity levels (events per minute) without logging individual keystrokes.
The agent requires no elevated privileges, no kernel extensions, and does not use screen capture or accessibility APIs that would enable content reading. It runs with standard user permissions and can be uninstalled by the employee at any time.
Mitori captures browser activity at the domain level only \u2014 for example, "notion.so" or "docs.google.com". We do not capture full URLs, page content, search queries, form inputs, or any browsing history beyond the domain name.
This is sufficient to understand tool usage patterns (e.g. "the team spends 2 hours per day in Notion") without exposing any private browsing content.
Yes. Mitori supports SAML 2.0 and OpenID Connect (OIDC) for dashboard and admin portal access. We integrate with all major identity providers including Azure AD, Okta, Google Workspace, and OneLogin.
We provide a standard Data Processing Agreement that covers most requirements. For enterprise engagements, we are happy to work with your legal team on custom terms, additional contractual clauses, or specific jurisdictional requirements.
Use the trust document request form on this page, or contact security@mitori.ai to start the process.
We make this as straightforward as possible:
- Request our trust document pack using the form on this page
- Review our penetration test report (available under NDA)
- Schedule a live security architecture walkthrough with our team
- Submit your security questionnaire \u2014 we typically return completed questionnaires within 5 business days
Privacy by design
These are not features we added after the fact. They are constraints we built the entire platform around.
Data minimisation
We capture the minimum data required to deliver workflow insights. If we do not need it, we do not collect it. This is enforced at the agent level — the software cannot collect what it was not built to collect.
Purpose limitation
Data is used exclusively for the stated engagement purpose. No secondary use, no selling, no training machine learning models on your data. Ever.
Transparency
Every data point we collect is documented on this page. Every participating employee knows exactly what is observed before observation begins.
Erasure by default
Data does not persist indefinitely. It expires and is permanently deleted. This is the default behaviour — not an option you have to request.
Legal and review materials
Start with the public documents below, then request the specific review pack your team needs.
Data handling, retention, and individual rights.
Commercial and platform usage terms.
Request trust documents
Need procurement or security review materials? Send the request here and we'll follow up with the right pack.
Talk to our security team
For security enquiries, penetration test reports, compliance documentation, or a live security architecture walkthrough — we are here to help.