Security

Encryption

TLS 1.2+ in transit. AES-256 at rest for the database and storage buckets.

Access control

Row-level security on every user table — your data is scoped to your user ID at the database layer, not just in application code. Service-role keys are never exposed to clients. OAuth tokens are encrypted with envelope encryption.

Authentication

Email + password (with HIBP leaked-password check enabled), Google OAuth, optional SSO for teams. Session tokens are short-lived and rotated.

Audit & monitoring

All authentication events are logged. Production deploys run automated security scans on every release.

Responsible disclosure

Found something? Email security@mimo.app. We acknowledge within 48 hours.