Your data is protected — not just “somewhere in the system”
Every school in Mimiao is isolated at the database level, passwords are protected with Argon2id hashing, and the financial ledger is immutable — records cannot be edited or deleted after the fact. School data can be exported.
Each school is isolated at the database level
Your school’s data doesn’t sit in a shared pile next to everyone else’s. Mimiao is a multi-tenant system with row-level isolation (Row-Level Security): every query automatically sees only your school’s data, and that’s enforced by the database itself, not just by the application code. Even if two schools share student names or invoice numbers, they can never cross over. Which school you belong to is determined from your secure sign-in, never from the page address — so it can’t be spoofed.
Passwords are protected with modern hashing
We don’t store your passwords in readable form — and we can’t “peek” at them. Each password is turned into an irreversible hash using the modern Argon2id algorithm, with a unique salt per user. That means even our own team can’t see your password, and sign-in verification happens without ever reconstructing it. If you forget your password, it isn’t “sent” to you — you set a new one, because the old one doesn’t exist in readable form anywhere.
A financial ledger that can’t be rewritten
Money is the most sensitive part of a school, so financial records in Mimiao are immutable (append-only). No payment, refund or accrual can be edited or deleted after the fact — a mistake is corrected only with a new, compensating entry that also stays in the history. This gives every payment a complete, honest timeline: who, when and what for. It protects against two things at once — accidental mistakes and deliberate abuse — because quietly “adjusting the books” is simply not possible.
Everyone sees only what they should
Access in Mimiao follows your role, not chance. The owner, administrator, teacher, student and parent each work in their own cabinet, and each is shown exactly as much as their job requires. A teacher sees their own students and lessons, but not the whole school’s finances; parents see their own child, never someone else’s. Permission for every action is checked on the server with each request — limits can’t be bypassed by guessing a link or opening someone else’s page directly.
Your data is yours — and you can take it with you
We do not lock you in: student, payment and history data can be exported from the school. The specific hosting infrastructure depends on the deployed environment and its contracts, so the site does not promise a geography that the product configuration cannot verify.