Skip to content
EN
Try it free
EN
Try free for 14 days

Data security

Your data is protected — not just “somewhere in the system”.

Every school in Mimiao is isolated at the database level, backups run every six hours and are verified by a real restore, the financial ledger is immutable — and the platform is built so that even our own team cannot see your school’s content without your permission. And your data can always leave with you, via export.

Isolation

Your school is a space of its own.

Each school is isolated at the database level

Your school’s data doesn’t sit in a shared pile next to everyone else’s. Mimiao is a multi-tenant system with row-level isolation (Row-Level Security): every query automatically sees only your school’s data, and that’s enforced by the database itself, not just by the application code. What’s more, every request runs under a restricted database role that has no right to bypass that isolation. Which school you belong to is determined from your secure sign-in, never from the page address — so it can’t be spoofed. A dedicated suite of automated isolation tests runs on every code change.

What we see — and what we don’t

An honest answer to the uncomfortable question: “who on the platform side can see our data?”. Mimiao’s operations console is built so that it technically cannot return your school’s record content: no student or parent names, contacts or addresses, no note text, none of your payment amounts — that boundary is closed in code and pinned by automated tests, not by an internal “we don’t look” policy. The platform operator sees only the school’s name, plan, billing status and four anonymous counters — such as active students versus the plan limit. The only way inside a school is a support mode that activates solely after your prior approval, lasts at most 24 hours, shows everyone in the school a prominent banner, and writes every action into a log that cannot be edited.

Recovery

Backups that actually restore.

Backups that actually restore

A database backup is taken every six hours — and every one is verified: the system restores it into a test environment and checks the key tables before trusting it. A second, independent copy is stored in separate storage in a different region, protected against overwrites and deletion. Once a month an automated “restore drill” runs from that off-site copy: we don’t believe a backup works — we prove it. Before every production update an extra fresh backup is taken, and without it the update simply refuses to start. If any of these steps fails, the team learns about it immediately through several independent alert channels.

Infrastructure under watch — around the clock

Connections are protected with HTTPS and automatically renewed certificates, while the database and internal services are not reachable from the internet at all. Payment-integration keys are stored encrypted (AES-256-GCM) and cryptographically bound to your school — a copied blob cannot be decrypted anywhere else. Card data never reaches us in the first place: the payment provider handles it on its own secured side. Production is monitored around the clock with automatic alerts: the team learns about a failure, a suspicious error or a missed backup from an alert — not from a customer’s email.

Money & access

The sensitive parts, under control.

A financial ledger that can’t be rewritten

Money is the most sensitive part of a school, so financial records in Mimiao are immutable (append-only). No payment, correction or accrual can be edited or deleted after the fact — a mistake is corrected only with a new, compensating entry that also stays in the history. Mimiao’s rules do not allow silent edits to financial records. Every payment keeps a complete, honest timeline — who, when and what for.

Sensitive actions on the four-eyes principle

A school can switch on approval mode: lesson-balance adjustments, debt write-offs, invoice cancellations or a “paid” mark are then never executed by one person alone. The action first becomes a request that the owner — or an administrator, if you configured it that way — has to approve, in the system or simply with a button in Telegram. Whoever created the request can never approve it themselves, and once approved the action runs with all the usual validations, as if new. It’s the same four-eyes principle that big-company accounting relies on — now available to a school behind a single switch (from the Studio plan).

Sign-in, passwords and instant permission revocation

Passwords are never stored in readable form: each is turned into an irreversible hash with the modern Argon2id algorithm and a unique per-user salt, so even our own team can’t see them. Sign-in attempts are rate-limited, and the system answers every failure identically — brute-forcing passwords or probing whether an email exists gets nowhere. Access follows the role: a teacher sees only their own students and never anyone’s pay or the school’s money; parents see only their own child. And crucially: when you revoke someone’s permission, it disappears with their very next request — even in already-open tabs, with no old sessions living on.

Your data is yours — and you can take it with you

We do not lock you in. The school owner can request an export of students, lessons, invoices, payments, attendance and homework as plain CSV files no more than once every 24 hours; the archive is generated asynchronously and the download link stays valid for a limited time. An individual student’s personal data can be irreversibly anonymised while preserving only the integrity needed in the active financial history. A subscription lapse does not itself trigger deletion: the owner keeps read access and can renew later. After separately confirmed closure, the school has 30 days to export; active data is then deleted and disaster-recovery copies rotate within at most another 30 days. Actual countries and providers appear in the public recipient register.

Mimi

AI behind the same access boundaries

Mimi is read-only and follows the user’s permissions. The owner separately enables AI, accepts current school-data-sharing terms and optionally enables learner-answer feedback. Without live-data consent, product help remains available. Current searches exclude contacts, bank details, internal notes and files. Mimiao does not keep prompt and response text as conversation history; explicitly accepted teaching drafts become ordinary CRM content.

Documents

Legal terms, data processing and the recipient register are public.

Questions about your school’s data? Write to us · mimiaobusiness@gmail.com